The .locked Folder in a Medical Billing Unit
A 40-person medical billing company in Udaipur processes insurance claims for a US hospital client. Twelve billing PCs share one Windows login, 'billing1', and staff save files in a shared folder. The admin password is on a sticky note under the reception keyboard. On Tuesday morning a biller opened an email attachment named Invoice_Oct.zip; by afternoon files in the shared folder had the extension .locked and a text file demanded payment in cryptocurrency. The only backup is a nightly copy onto a USB hard disk kept on the same table, and nobody has restored from it since March. Separately, three staff admitted they use personal Gmail to send spreadsheets when the client's portal is slow. The client contract requires notification of any breach within 24 hours. The owner wants to pay the ransom quietly and to keep the Gmail practice because it keeps the work moving.
1. Set out the first six hours in order, and say what you preserve and what you do not do.
Read the worked answer
Containment comes before investigation, because every hour of spread is an hour of new damage.
0-30 minutes. Unplug Ethernet cables and disable Wi-Fi on affected PCs. Do not reimage, do not run a cleaner, do not restart repeatedly - you lose volatile evidence and may trigger further encryption. Photograph the ransom note and the .locked filenames with timestamps, and note which account was logged in. If encryption is still visibly spreading, isolate faster than you document.
30-60 minutes. Inform the owner. Stop all staff using the shared folder. Unplug the USB backup drive and check whether its files also end in .locked - it sat on the same table and was probably mounted, so assume it is encrypted until proven otherwise. That assumption changes the recovery plan entirely.
1-2 hours. Disable 'billing1' and reset credentials from a clean device. Enable MFA on email and the client portal. Check mailbox rules for auto-forwarding, which attackers commonly add.
2-4 hours. Notify the client within the contractual 24 hours by phone plus email to the named contact - this is an incident affecting their data even before the scope is known. Report the incident to CERT-In, whose 2022 directions require specified cyber incidents to be reported within six hours of noticing.
4-6 hours. Preserve logs and the timeline, keep one infected machine untouched, and restore only from a backup verified clean on a separate machine.
Do not: pay the ransom, delete the ransomware, reimage everything before evidence is captured, or use an infected PC to email the client.
2. Rank the practices described by risk, and give the first three controls you would fund on a small budget.
Read the worked answer
Ranking, with reasoning.
- Shared login 'billing1' on twelve PCs. This is first because it makes everything else unenforceable: you cannot attribute an action, revoke one person, or apply least privilege, and the scope of any breach becomes 'everyone'. It is also how one user's mistake becomes forty people's problem.
- Personal Gmail for claims data. An uncontrolled copy of regulated client data, outside logging, outside retention policy, and a contract breach independent of the ransomware. If those mailboxes are compromised, the company may never find out.
- Backup on the same table, never restored since March. A backup that lives next to the originals and has never been restored is a hope, not a backup - proven the moment the USB drive also turned out to be encrypted.
- Sticky-note admin password. Cheapest to fix and a plausible path for lateral movement.
First three controls, cheapest first.
- Named accounts and no standing admin rights. The admin password moves to a password manager or a sealed envelope. Mostly staff time, little cash.
- MFA on email and the client portal, plus attachment blocking for .zip and .js at the mail gateway. Low monthly cost and it addresses the exact entry point of this incident.
- 3-2-1 backup: one offline or immutable copy, one offsite, and a restore test each month with a written result signed by a named person.
Then the human control. An acceptable-use policy with signed acknowledgement plus one approved, logged file-transfer route, so staff are not forced back to Gmail by a slow portal.
3. The owner wants to pay the ransom and keep quiet about the Gmail use. Respond as an adviser, separating what you are confident about from what you would verify.
Read the worked answer
On paying. There is no guarantee of decryption, and modern variants commonly steal data before encrypting, so payment does not undo the exposure. It funds the next attack, may itself create legal and contractual problems, and signals to staff and to the market that the company pays. Recommend rebuilding from a verified clean backup instead.
On keeping quiet. Not available. The contract requires notification within 24 hours, and hiding the Gmail channel after a breach is worse than the channel itself - it turns a security failure into concealment. The data is the client's patient data, so the client's own regulatory obligations are triggered by your incident and they cannot meet them if you delay.
What I am confident about. The contractual 24-hour notice to the client; CERT-In's 2022 directions requiring specified cyber incidents to be reported within six hours of noticing; and India's Digital Personal Data Protection Act 2023, under which a Data Fiduciary must notify the Data Protection Board and affected Data Principals of a personal data breach.
What I would verify before acting. The exact CERT-In reporting format and category; the DPDP Rules' notification particulars and timelines as they are operationalised; whether the client's contract sets a shorter clock than 24 hours; and whether the client's counsel wants to lead the notification. Draft the notice with someone who knows the contract, and log every call with a timestamp.
On Gmail. Suspend the practice today, give staff one approved route - the client portal or an encrypted transfer with logging - and disclose the past use to the client with dates and what was sent. Uncomfortable, but it is the only version that survives an audit.