02:40 Ransomware at a Regional Hospital
At 02:40 on a Saturday, a 320-bed regional hospital's SOC receives EDR alerts from 140 of its 900 endpoints. By 06:00, the EHR application servers and the PACS imaging archive are encrypted, and the EHR has been down for four hours against a stated RTO of eight hours. The backup catalog server is also encrypted. The last successful restore test was eleven months ago; nightly fulls exist on tape plus a weekly offsite copy. The ransom note demands 45 BTC within 72 hours and claims that 120 GB of patient records were exfiltrated, including oncology and behavioral-health charts. The CISO must brief the CEO at 08:00. Clinical staff are on paper downtime procedures, the emergency department is diverting trauma cases, and the incident response retainer's forensics team will not arrive for another nine hours. The CIO asks whether the hospital should just pay and be back online by evening.
1. Rank the actions for the first eight hours before the forensics team arrives, and state the trade-off you are accepting with that ordering.
Read the worked answer
Order: (1) patient safety - activate downtime procedures, divert where clinically required, and confirm no life-safety systems are affected; (2) contain - isolate the encrypted VLANs, kill VPN and RDP ingress, rotate privileged and service-account credentials, block the C2 indicators at egress; (3) preserve the cheap, perishable evidence - capture memory of the domain controllers and file servers, export EDR telemetry and firewall logs to out-of-band storage. This takes under two hours and is gone forever once machines are rebooted or rebuilt; (4) rebuild in priority order from the weekly offsite tape, validating the restore in an isolated clean environment before rejoining the domain.
The trade-off must be stated explicitly: restoring overwrites host evidence, so forensics works from images and telemetry rather than live servers. That is acceptable because the decryptor path and the restore path both need EHR up, and a forensic-perfect but offline hospital harms patients. Do not power off encrypted hosts - memory is lost. Do not wait nine hours for the retainer before containing or restoring.
2. The attackers claim 120 GB of PHI was exfiltrated. How should the CISO handle breach-determination and notification while forensics is still nine hours away?
Read the worked answer
Treat the claim as a reportable event until evidence says otherwise. The HIPAA clock runs from discovery, not confirmation, and the four-factor risk assessment - nature and extent of PHI, the unauthorized recipient, whether the data was actually acquired, and the mitigation - must be reasonable, documented, and completed without unreasonable delay, with outside notification inside 60 days of discovery.
Evidence to gather immediately: egress volume against a 72-hour baseline, NetFlow to the claimed C2 address, presence of archive or staging utilities and their logs. If log retention covers only 30 days and the intrusion began 45 days ago, that gap itself argues for notification rather than against it. Because the claimed dataset includes behavioral-health records, state law adds stricter rules, and the 500-resident media-notification threshold is easily crossed for a regional hospital. The message to the CEO is not to stay silent because exfiltration is unproven; it is to investigate fast, start the assessment now, and document the reasoning at each step so a regulator sees a defensible process.
3. Should the hospital pay the 45 BTC? Give a decision framework the CEO can act on at 08:00.
Read the worked answer
Structure it rather than treating it as a coin flip. Against paying: decryptors are frequently defective or partial, payment does not recall exfiltrated data, it funds the next attack, and paying a sanctioned actor can create OFAC exposure even for a victim - legal must screen the wallet. For considering it: 45 BTC is small against multiple days of EHR downtime and trauma diversion, and if the tape restores fail the hospital may face weeks offline.
The framework: (a) start restoration now, in parallel - the ransom decision must never gate clinical recovery; (b) have the IR firm test the decryptor on two sacrificial, imaged servers only, never on production; (c) escalate the payment decision to the board with counsel and law enforcement, with a written business rationale and an explicit acknowledgment that deleted-data promises are unenforceable; (d) fix root causes in the same conversation - an eleven-month-old restore test and a backup catalog on the same domain as production are the real failures here, not the malware variant.