Ransomware at a Clinic Network With Unconfirmed Exfiltration
Aster Care runs 14 outpatient clinics in the US and Ireland. On a Friday, ransomware encrypts the billing server. The attacker claims to have exfiltrated 40 GB, including a reporting export folder that was not encrypted at rest. The main patient database uses AES-256 encryption, but analysts cannot yet rule out credential theft. The incident affects about 12,000 patients, including 300 Irish residents. The FBI has been contacted; a ransom demand of $250,000 is due in 72 hours. The forensic firm says attribution and exfiltration confirmation will take 10 days. The Irish DPO is on leave. The US privacy officer wants to wait for forensics before notifying. Media have not called. The company has cyber insurance but the carrier requires a notification decision within 48 hours.
1. Should Aster Care notify under GDPR and HIPAA? Explain the risk assessment and timing.
Read the worked answer
Likely yes for GDPR, and yes for HIPAA unless the company can demonstrate a low probability of compromise. Under GDPR, the clock starts when the controller becomes aware of the breach, not when forensics finishes. Awareness exists once there is a reasonable degree of certainty that a security incident occurred and personal data may be affected. Here, the unencrypted export folder and possible credential theft create a risk to rights and freedoms, even though the main database is encrypted. The Irish DPC should be notified within 72 hours with the information available, and updated later. The 300 Irish residents should be notified without undue delay if there is a high risk, especially if exfiltration is confirmed.
Under HIPAA, a breach is presumed unless a four-factor risk assessment shows low probability of compromise. Encryption mitigates only if keys were not compromised. The unencrypted export and credential uncertainty weigh against a low-probability finding. Notification to affected individuals is due within 60 days, HHS must be notified, and media notice is required if more than 500 individuals in a state are affected. Waiting 10 days for forensics is not a reason to miss the 72-hour GDPR deadline; use phased notification.
2. What should the 72-hour notification contain, and how should the company handle the unconfirmed exfiltration?
Read the worked answer
The GDPR notification should describe the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, and the measures taken or proposed. It should name a contact point, likely the DPO or a deputy because the Irish DPO is on leave. Aster Care should state what is known, what is not known, and when it will update the regulator. It should not speculate beyond the evidence but should not downplay the unencrypted export folder or credential risk.
For unconfirmed exfiltration, the company should use the 'phased notification' approach: notify now with the facts available, explain that forensic review is ongoing, and commit to a timeline for further updates. It should preserve logs, isolate the server, reset credentials, and review the export folder's contents to determine data categories. If the attacker's claim is the only evidence, say so. For individuals, the company can wait briefly for the high-risk assessment, but it should prepare a notification that explains the risk and protective steps. It should also align the GDPR and HIPAA messages so that affected individuals do not receive contradictory accounts.
3. What are the legal and practical considerations around paying the ransom and cooperating with the FBI?
Read the worked answer
Paying the ransom is not automatically illegal in the US or Ireland, but it carries sanctions risk, may fund criminal activity, and does not guarantee deletion or non-publication. The company should screen the attacker against OFAC sanctions lists and consult counsel before any payment. Cyber insurance may cover negotiation or payment, but the carrier may also require notice and may have its own approved negotiators. The FBI generally discourages payment and may ask the company to delay or cooperate in a sting; cooperating is a business decision but can affect insurance and regulatory expectations.
Practically, Aster Care should preserve evidence, maintain a communication log, and avoid unilateral contact with the attacker. It should not let the ransom deadline drive the breach-notification timeline. Law enforcement cooperation does not excuse GDPR or HIPAA obligations. The company should also assess whether payment could constitute a transfer to a sanctioned entity and whether the board needs to approve the decision. Finally, it should document the rationale, because regulators and insurers will ask why the company paid or refused.