1) Storing the keys for the encrypted file also on the network.
2) Why even bother to write that the attacker deleted the files from the network? no backups?