A customer has a 10GB volume with an 8GB LUN that is using 7GB.

The likely cause for the disappearance of all snapshots after a ransomware attack that encrypted all files on the LUN is the Snapshot autodelete feature. When the volume becomes full due to the encryption, the autodelete feature removes older snapshots to free up space, preventing the volume from running out of space and ensuring write operations can continue.

For more information, see:

NetApp Documentation on Snapshot Autodelete

NetApp Community Discussion on Snapshot Deletion