Ransomware at a Regional Hospital, Hour Six

First six hours:

1. Convene: incident commander, clinical leadership, legal, communications, insurer, and the law-enforcement contact. Clinical continuity is the first priority and is not a security decision.
2. Contain: disable the vendor RMM account and remove the tool, revoke remote access, segment the four encrypted servers and the backup server, block command-and-control indicators, and reset privileged credentials - including krbtgt twice if a domain controller was reachable.
3. Preserve: image before reimaging, capture memory from a live encrypted host if possible, retain RMM logs and the ransom note with timestamps, and log every action as it happens.
4. Eradicate before restoring: identify initial access and all persistence, or the environment re-encrypts overnight.
5. Restore in clinical tiers.

The trap is that a fast restore looks like heroism and produces a second wave. The backup server was domain-joined and shared the privileged account used for nightly jobs, which is exactly why it fell. Restoring on top of that environment reproduces the conditions of the original compromise and destroys the evidence needed for the notification decision. Speed should be measured to the first clean, stable clinical system, not to the first server that boots.

Preconditions:

• Initial access is closed: RMM removed, vendor access reissued with MFA and least privilege, edge devices patched, and every credential class rotated - domain, local, service, backup, hypervisor, and cloud.
• Backups are verified clean: inspect the immutable copy's index, restore one server to an isolated clean room, scan it, and confirm the copy predates the intrusion.
• A rebuild target exists: new or wiped hosts, not 'cleaned' production.
• Heightened monitoring is live with someone watching before data returns.

Sequencing: restore identity and network foundations first - DNS, DHCP, domain services, virtualisation - then rebuild the management and backup infrastructure itself, since you cannot safely recover clinical systems while your recovery tooling is untrusted. Then clinical priority: laboratory and imaging, then the EHR, then scheduling, billing, and email. Each tier gets clinical sign-off and a monitored bake-in period before the next begins.

Also set expectations early. Restoring hundreds of servers over a constrained link, with imaging and archive stores dominating capacity, will not fit into one night. Publish a realistic timeline to the CMO on day one rather than revising it hourly, because clinical planning depends on it.

Facts that matter:

• Whether the decryptor works and whether the actor has a track record. Keys frequently fail on large or proprietary data sets, so backup viability decides much of this.
• Whether the actor is sanctioned. Paying a sanctioned entity creates legal exposure regardless of intent; screen the group and any wallet.
• Whether exfiltration is real and regulated. Nine hundred gigabytes is a claim, not a finding - validate with egress logs, DLP, and the sample the actor provides.
• Cost of downtime versus the demand, including diversion and regulatory penalty, calculated by the CFO.
• The insurer's coverage position and law enforcement's recommendation.

Who decides: the CEO with legal counsel, board and insurer informed. Security's role is to make the technical reality clear - payment does not guarantee recovery and does not extinguish notification duties - not to make the call.

For the CMO: 'we cannot confirm or exclude exfiltration yet, and we are treating it as a breach until proven otherwise', followed by the specific checks underway and the notification timeline. Under HIPAA the clock runs from discovery and 60 days is a ceiling, not a target. Speculation given to a clinician becomes a ward rumour within the hour, so say what is known, what is not, and when the next update comes.