Ransomware, an Unproven Backup, and a Friday Deadline
A 220-bed community hospital's EHR is encrypted on a Tuesday morning. The ransom note demands 40 BTC, about $1.1 million at the time, and threatens to publish 84 GB of patient records including 12,000 oncology files. The FBI field office says a known affiliate group is probably responsible and asks the hospital to delay notification while it works. The cyber insurer covers ransom but requires pre-approval and OFAC screening. The general counsel wants to pay by Friday to restore systems. The CISO has an immutable backup from Sunday, but the restore has never been tested and the backup server shares a domain admin credential that was likely compromised. State breach law requires notice without unreasonable delay, and HIPAA sets a 60-day outer limit. A cryptocurrency broker has offered to handle the transaction.
1. Build the pay-versus-restore decision framework, including the sanctions question.
Read the worked answer
Payment is not a technical decision and should not be made on the general counsel's Friday deadline alone. The framework has four limbs.
Legal. Paying a ransom to a person or entity on the OFAC SDN list, or to a blocked jurisdiction, can itself violate sanctions. Before any transfer, screen the demanded wallet, any intermediate addresses, and the broker against OFAC lists and run chain analysis to see whether funds trace to a sanctioned mixer or exchange. OFAC has published guidance on ransomware payments and encourages victims and their representatives to report and cooperate; voluntary self-disclosure of a prohibited payment can mitigate penalties but does not cure the violation.
Recoverability. An untested Sunday backup is not a recovery plan. If the backup server shares a compromised domain admin credential, the attacker may have reached it. Verify integrity, isolation, and restore into a clean environment before treating restoration as the alternative.
Leverage. Paying does not guarantee decryption, does not prevent publication, and funds the next attack. The affiliate model means the group may not honor its word.
Insurance. Pre-approval is a condition of coverage; proceeding without it risks the claim. The broker's involvement should be documented and screened.
2. The FBI asks the hospital to delay notification. How should the hospital reconcile that with HIPAA and state law, and what should it actually do this week?
Read the worked answer
A law enforcement request to delay is a request, not a legal shield. HIPAA requires notification without unreasonable delay and no later than 60 days from discovery; state law may be stricter. The hospital can honor a short, documented delay where law enforcement certifies that notification would impede an investigation, but it cannot let a verbal request push it past statutory deadlines, and it should get the request in writing with a stated period.
This week: convene the incident response team and counsel; determine the discovery date and calendar the 60-day HIPAA deadline; identify which state laws apply to the patients in the 84 GB set; preserve evidence, including ransom note, wallet addresses, and affected system logs; and begin drafting notification letters so the hospital is ready if the delay is lifted. If more than 500 residents of a state are affected, HHS and prominent media notice are triggered under HIPAA.
The FBI delay does not relieve the hospital of its own risk assessment. If the hospital concludes that delay is not justified, it should notify and tell the FBI it is doing so. Document every decision, the legal basis, and who approved it - regulators and plaintiffs will ask.
3. What must the CISO verify before reconnecting the restored environment, and why is the shared domain admin credential the central problem?
Read the worked answer
The shared domain admin credential means the attacker may have domain-wide persistence that survives a restore. Verify, in order: that the backup media is genuinely immutable and offline, and that its contents predate the intrusion; that the restore target is a clean, segmented network with no route to production; that hashes of restored system files match known-good baselines; and that no unauthorized scheduled tasks, services, or local administrators exist on restored hosts.
Then address identity. Reset the krbtgt account twice, with an interval, to invalidate forged Kerberos tickets. Rotate every domain admin and service account password, remove the shared credential entirely, and rebuild any host that held it. Check for Golden Ticket artifacts, DCSync activity, and new forest trusts.
Only after eradication should the hospital reconnect in stages, starting with clinical systems that are not domain-dependent, and monitor with EDR and network detection during the first weeks. Reconnecting before these steps risks re-encryption and tells patients and regulators that the hospital restored into the same compromised state.