"Wanna" ransomware outbreak. Please see this Sophos article sophos.com/kb/126733 for advice on how to protect your organization. Immediate action recommended.
When the Device Control policy for Sophos Anti-Virus for Mac is changed from Allow to Deny for Optical Drives or Removable Storage, currently plugged-in devices are ejected. Desktop notification and management events for this change are not sent.
All attached devices must be re-mounted when the Device Control policy changes. This means that if the policy changes to now block a device, and that device is already attached, then it will be ejected.
First seen in Sophos Anti-Virus for Mac OS X
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. If you need technical support please post a question to our community. Alternatively for licensed products open a support ticket.