Service identification of ransomware impact at account level

A system comprising:

• one or more hardware processors;
• and
• a memory storing instructions that, when executed by the one or more hardware processors, cause the one or more hardware processors to perform operations comprising:
• determining features of files in a storage account of a cloud storage server, the storage account registered with a client device;
• detecting ransomware activity based on the features of the files;
• generating a notification to the client device in response to detecting the ransomware activity, the notification indicating the detected ransomware activity in the storage account, and one or more remediation options for the detected ransomware activity in the storage account;
• receiving, from the client device, a remediation option selected from the one or more remediation options;
• recovering one or more files in the storage account based on the selected remediation option;
• receiving, at the cloud storage server, a request from the client device to perform changes to one or more files in the storage account of the cloud storage server;
• and
• prior to detecting the ransomware activity, completing the requested changes to the one or more files in the storage account of the cloud storage server.

A non-transitory machine-storage medium storing instructions that, when executed by one or more processors of a machine, cause the one or more processors to perform operations comprising:

• determining features of files in a storage account of a cloud storage server, the storage account registered with a client device;
• detecting ransomware activity based on the features of the files;
• generating a notification to the client device in response to detecting the ransomware activity, the notification indicating the detected ransomware activity in the storage account, and one or more remediation options for the detected ransomware activity in the storage account;
• receiving, from the client device, a remediation option selected from the one or more remediation options;
• recovering one or more files in the storage account based on the selected remediation option;
• receiving, at the cloud storage server, a request from the client device to perform changes to one or more files in the storage account of the cloud storage server;
• and
• prior to detecting the ransomware activity, completing the requested changes to the one or more files in the storage account of the cloud storage server.