Ransomware at 02:14: Containment Versus the Troponin Interface

The choice is not between security and patient safety; a whole-site isolation that blinds the emergency department creates a second incident. The defensible position is aggressive but segmented containment.

First hour:

• Isolate the affected VLANs and every endpoint on the EDR hit list immediately, then hunt for lateral movement before assuming the boundary is correct. Given 60 encrypted endpoints, assume domain compromise.
• Protect the clinical lifeline explicitly. Keep the lab interface and the troponin pathway running on a documented out-of-band route, with an agreed manual result-reporting procedure activated between the ED and the laboratory. Name a clinical owner for that decision.
• Disable the likely vectors (SMB where not needed, remote management exposed to the estate), block known command-and-control indicators at the egress, and force a reset of privileged credentials after capturing evidence.
• Preserve before rebuilding. Capture volatile memory from a small number of representative hosts before rebooting them; rebooting destroys the evidence you will need to scope the exfiltration claim.
• Convene the incident management team with clinical representation, and log decisions with timestamps. This matters more than choosing perfectly, because the regulator and insurer will assess whether decisions were reasoned, owned and contemporaneous.

Awareness starts at 02:14 on Saturday, so the regulatory clock is already running and the default deadline is 02:14 on Tuesday for a personal data breach notification, with any sector-specific early warning (for example a 24-hour early warning under NIS2-style rules) potentially due sooner.

• Do not wait for full scoping. Notify with what is known, state that the investigation continues, and update. Phased notification is expressly contemplated by the 72-hour model; silence is not.
• Determine the exfiltration question separately. A ransom note claiming 3 TB is evidence, not proof. Hunt for staging, archive creation and egress in proxy and firewall logs, and let the answer shape the content and audience of the notification, not its timing.
• Engage law enforcement and the insurer now; the four-hour callback is too slow for a decision, so escalate to the insurer's duty manager and record the attempt.
• On the ransom: payment is a business and legal decision for the board, not the CISO. Run sanctions screening on the wallet and actor, take legal advice on whether payment itself is lawful, and recognise that paying neither discharges notification duties nor guarantees deletion. Most importantly, do not let a payment deadline compress clinical recovery decisions.
• Comms: prepare a holding statement before the press writes the story, and align patient, staff and regulator messages.

An unverified 14-month-old backup is a hypothesis, not a recovery capability, and in ransomware incidents backups are frequently targeted first precisely because they are trusted.

Sequence:

• Assume the backup estate is compromised. Check backup catalogue integrity, immutability settings, and whether backup credentials or the management console were accessed. Restore into an isolated environment, not onto the production domain.
• Prepare a clean landing zone. Rebuild domain controllers and privileged accounts from scratch or from known-good media, with new credentials and new krbtgt, before any data is returned. Restoring an encrypted-adjacent estate onto a compromised domain invites re-encryption.
• Restore in clinical priority order, agreed by the chief medical officer: laboratory and results interface first, then ED systems, then PACS with a documented image-retrieval fallback, then scanned referrals, which can be re-digitised if the data is unrecoverable.
• Validate with clinical users, not only with checksums; a PACS that opens but cannot retrieve priors is not recovered.
• Expect data loss. Fourteen months of unverified backups means the RPO is effectively unknown; document the gap and notify affected services.
• Afterwards: move to immutable, offline-copy backups with quarterly restore tests, and make verified restore a board metric rather than a technician's private doubt.