Ransomware at a Regional Health System: Which Link in the Chain Matters Most
Northbridge Health, a three-hospital system with 6,800 staff and $1.1B in revenue, lost access to its EHR for nine days after an intrusion that began through an unpatched internet-facing VPN concentrator. The attacker moved laterally for 11 days, exfiltrated 62,000 patient records and 4 TB of finance data, then deployed encryption across 1,900 endpoints. The ransom demand is $4.5M; the firm's negotiator estimates typical settlements at 15–25% of demand. Nightly backups exist but replicate to a NAS joined to the same Active Directory domain; an immutable offsite copy lags by 36 hours. The attacker monitored internal email for five days before encrypting. Board members are asking why anti-phishing training, which consumed 40% of last year's security budget, did not prevent this.
1. Map the intrusion to its stages and identify where the chain could most cheaply have been broken. Justify your ranking with the specifics of this incident.
Read the worked answer
Stages: initial access (unpatched edge VPN), persistence and privilege escalation in Active Directory, 11 days of lateral movement and discovery, collection and exfiltration (62,000 records, 4 TB), email surveillance, then impact. Rank breakpoints by cost per unit of risk removed, not by theoretical strength.
- Edge patching plus MFA on the VPN. This closes the exact initial-access vector for tens of thousands of dollars and defeats an entire class of commodity affiliate, not just this actor. Highest leverage.
- Logging and detection during the 11-day dwell. The attacker operated undetected for over a week; centralized authentication logging with alerting would plausibly have caught credential dumping or bulk file access. Moderate cost, and it breaks the chain late but still before encryption and before exfiltration completes.
- AD tiering and segmentation. Limits blast radius from 1,900 endpoints; expensive, so it ranks third on cost-effectiveness even though its severity reduction is the largest of the three.
Immutable backups and phishing training do not appear in the top three: neither addresses this actor's entry path or its extortion model.
2. The CISO proposes cutting phishing training from 40% to roughly 10% of the security budget and redirecting the difference to segmentation and identity hardening. Evaluate the proposal.
Read the worked answer
Directionally right, but the reasoning matters more than the number. The incident is evidence about this actor's chosen path, not proof that training has no value: entry was an unpatched edge device, yet five days of mailbox surveillance implies some credential or mailbox compromise in the chain, which phishing-resistant MFA and awareness activity can affect. The defensible case for reallocation is marginal return - 40% of budget on awareness is unusual for any organization, and the marginal dollar there buys less loss reduction than closing the admin-account MFA gap or segmenting the EHR from corporate IT.
Risks in the proposal: recency bias, optimizing for the last attack rather than the threat model; and the fact that training is cheap per employee and supports both insurer expectations and regulatory questions. A defensible allocation keeps training at a floor that sustains simulation and reporting culture (roughly 10–15%), funds identity hardening first because it is fast, demonstrable and closes a known gap, and phases segmentation, which is a multi-year architectural change that cannot be finished before the next renewal.
3. The attacker read internal email for five days before encrypting. What does that do to the argument that backups make the ransom irrelevant?
Read the worked answer
It defeats it. Backups restore availability; they do nothing about confidentiality, and this is a data-theft extortion, not only a downtime event. Two consequences follow.
First, the leverage is the 62,000 patient records and 4 TB of finance data. Notification, credit monitoring, regulatory penalty and litigation costs scale with record count and with what sat in the mailbox - none of which a restore addresses. The 36-hour replication lag matters for availability only; it is irrelevant to the extortion.
Second, five days of mailbox access means the attacker likely saw negotiation strategy, cyber insurance limits, retention and legal advice, vendor contacts, and possibly wire instructions. That creates follow-on business email compromise and payment-diversion risk that outlasts the encryption event. Practical implications: treat the mailbox as compromised (credential rotation, review of outbound payment controls and any vendor bank-detail changes since the intrusion), assume the demand is informed by known insurance limits, and model the loss as confidentiality-driven rather than availability-driven when setting reserves and limits.