Ransomware at 02:10: Containment Scope and the Payment Question

Availability is the property under active attack: 3,200 files changed in six minutes on a server clinical staff depend on. Integrity is also degraded because encryption rewrites content. Confidentiality is unknown, and that matters most - modern ransomware operators routinely exfiltrate before encrypting, so absence of evidence is not evidence of absence and the incident must be treated as a possible ePHI breach until proxy, firewall, and DNS logs prove otherwise. Severity should be driven by patient-safety impact rather than file count: two operating rooms losing imaging access is a clinical outage, which pushes this to a major incident requiring executive and clinical leadership notification. A minor-incident classification would be wrong because the blast radius crosses a clinical service boundary and the affected account holds local admin on multiple systems. The regulatory clock also starts once unauthorized access to ePHI is suspected, so Legal and Privacy belong in the first bridge call, not the tenth.

First 15 minutes: disable the technician's domain account, reset the password twice, and revoke its Kerberos tickets; a krbtgt reset is only warranted if there is evidence of a golden ticket, because it is disruptive. Second: network-contain the 14 workstations and the file server through EDR isolation so encryption stops while other clinical paths keep working. Third: identify and block the command-and-control channel at egress using proxy, firewall, and DNS logs keyed to the phishing email and the note. Fourth: preserve volatile evidence on one representative host - memory image, process list, netstat, scheduled tasks - before any reboot, since the encryptor and credential-theft artifacts vanish afterward. Fifth: verify backup integrity by mounting a restore into an isolated segment and scan the NAS for the same indicators; a domain-joined backup target is a lateral-movement target, not an asset. Do not power hosts off - isolate them, so the memory evidence survives.

Isolate hosts, not the VLAN, unless evidence shows east-west spread. Full VLAN isolation severs the imaging archive from the operating rooms and creates a second, self-inflicted outage; containment has to be proportionate to observed spread. Fourteen workstations plus one server is bounded, and EDR isolation stops the encryption loop as effectively as a VLAN ACL. Keep a documented rollback, re-evaluate every 30 minutes, and escalate to VLAN shutdown if new hosts appear outside the east wing. On payment: not as a first option. Backups exist and the restore path is testable, payment funds the operation without guaranteeing usable keys, and it may create sanctions exposure if the actor is designated. Frame the decision as restore time versus clinical downtime rather than morality alone. If restore would exceed the surgical window, consider payment only after legal, executive, and law-enforcement consultation - and rebuild anyway, because decryptors are unreliable.