Ransomware at a 310-Bed Hospital: Declared Versus Achieved RPO
Northgate Regional Health operates a 310-bed hospital with a 24x7 emergency department and a declared RTO of 4 hours for its electronic health record (EHR) and 1 hour for the laboratory information system (LIS). The DR plan states an RPO of 15 minutes for clinical systems. At 02:40 on a Saturday, a ransomware operator holding domain administrator credentials detonates encryption across the primary data center. The NAS array holding the nightly full backups and hourly snapshots is domain-joined and was encrypted first. The only surviving copies are LTO-8 tapes in an offsite vault: a full backup from six days ago plus daily incrementals through Thursday night; the Friday incremental never left the building. The vendor-hosted imaging module is unaffected but cannot authenticate against the on-premises domain. The CISO wants to declare a disaster within the hour. The CIO wants to know whether paying the ransom is faster than the tape restore, which the storage vendor estimates at 14 hours.
1. At 02:40 Saturday, what is Northgate's actual RPO, and how should the 15-minute figure be characterized in the incident record?
Read the worked answer
Separating three different numbers
Declared RPO (plan): 15 minutes, achieved in normal operations by hourly snapshots plus transaction log shipping.
Achieved RPO (this event): the offsite tape set is complete only through Thursday night's incremental. The loss window therefore runs from approximately Thursday 23:00 to Saturday 02:40 - roughly 28 hours, not 15 minutes.
Mechanism RPO (going forward): effectively undefined for backup data, because the snapshot and full-backup tier was domain-joined and encrypted first. The 15-minute capability was not merely missed; it was designed in a way that let a single compromised domain account destroy both the primary data and its near-line copies.
Why the reasoning matters
The plan figure describes an aspiration under normal failure, not the outcome under a targeted attack. Restating "RPO 15 minutes" to clinicians or the board would be materially misleading. The incident record should say: up to 28 hours of clinical data may require reconciliation from source systems and paper records for systems restored from tape.
Two follow-ups before the number is final
- Check whether the hosted imaging module, the LIS analyzer interfaces, and the interface engine retain their own journals or vendor-side replicas; those can shrink the effective loss window for specific data types.
- Check whether any tape is unreadable or the catalog is itself stored on the encrypted NAS - a catalog loss adds days, not hours.
Record the gap between declared and achieved RPO as a formal finding; it is the evidence base for the funding request that follows.
2. Sequence the first 12 hours. Where, if anywhere, does ransom payment fit into the technical recovery?
Read the worked answer
Parallel tracks, not a queue
Run containment/forensics, clinical downtime operations, and restoration simultaneously under one incident commander.
Track A - contain and preserve (0–2h). Isolate the segment, disable compromised accounts, preserve volatile evidence, and confirm scope: which hosts, which service accounts, whether the hypervisor or backup catalog is affected. Do not begin wiping until scope is bounded, or restoration will re-infect.
Track B - clinical continuity (immediate). Downtime procedures: paper order entry, runner system, fax/phone result reporting, diversion decisions with the ED medical director. The 1-hour LIS RTO is only meaningful if the lab can report results without the EHR.
Track C - restore order. Identity first, not applications. Everything authenticates against AD, and the only AD backups predate the intrusion while the attacker held domain admin. The defensible path is a rebuild of the identity tier (new domain or clean build plus a double krbtgt reset, forced replication, credential reset for all privileged and service accounts) rather than an authoritative restore that reinstalls the attacker's persistence. Then LIS, then EHR, each restored into an isolated clean-room network, malware-scanned, patched, and validated before any domain join.
Where ransom fits
It is an executive/legal decision, not a recovery step, and it must not delay Track C. Reasons to keep it off the critical path: decryption tooling is frequently incomplete or slow, it funds and incentivizes the actor, it does not restore trust in the environment, and payment carries sanctions-exposure review obligations. Present it to the CIO as an option with an uncertain and unverifiable RTO, then get back to the tape restore.
Also start the regulatory clock and legal notification assessment in parallel - notification obligations run on their own timeline regardless of restore progress.
3. The CIO asks whether the tape path satisfies the 4-hour EHR RTO. Answer the question, then give the three changes you would fund first.
Read the worked answer
The answer is no, and by a wide margin
14 hours is only the data copy. Add integrity verification of six days of incrementals, application reinstallation and reconfiguration, interface re-pointing, identity rebuild, and clinical validation before go-live. Realistic elapsed time is 24–30 hours against a 4-hour commitment - a miss by roughly six times. The correct response is not to soften the RTO in the report; it is to state the gap, then choose deliberately between funding the capability and formally accepting the risk.
First three changes
Break the shared-fate dependency in the backup tier. Backups, snapshots, and the backup catalog must not be reachable with a domain account. Separate authentication plane, no domain join, MFA, deletion requires out-of-band approval. Immutable/object-locked copies for the hourly tier; tape alone is too coarse for a 4-hour clinical RTO.
Add a geographically separate, fast-restore copy for Tier-1 systems only. Replication or object-locked cloud copies for EHR, LIS, and identity. Tier-2 and Tier-3 can legitimately stay on tape with a 24–72 hour RTO - applying the expensive mechanism everywhere is what makes DR programs unaffordable.
Measure restores, don't assume them. Quarterly timed restore tests of Tier-1 into a clean-room environment, with the measured time written into the plan and reported to the board. Adopt 3-2-1-1-0 as the design rule: three copies, two media, one offsite, one offline/immutable, zero unverified restores.
If the organization will not fund items 1 and 2, the plan must be rewritten to state a 24-hour EHR RTO with executive sign-off, so that clinical leadership plans its downtime procedures against reality.