Laboratory Reports After Ransomware
A private medical laboratory handles about 2,000 patient reports a month. Six staff share one Windows computer at the reception desk. Reports are typed in Word, saved to the desktop, and emailed to patients from a shared Gmail account. The password is written on a whiteboard behind the desk. Staff also send PDF reports through WhatsApp when patients ask. A nightly backup copies the desktop folder to a USB drive and to the technician's personal laptop at his home. Last month a ransomware email was opened; encrypted report files were found the next morning. The laboratory paid a small ransom to recover three files. The owner now wants a one-page security plan but says staff cannot cope with 'complicated' systems, and the laboratory must keep working during clinic hours.
1. Identify the most serious weaknesses in this setup and explain which ones turn a single mistake into a laboratory-wide loss. Prioritise them.
Read the worked answer
The serious weakness is not one mistake but the absence of separation and recovery.
- Shared account and exposed password: all six staff use one Windows login and one Gmail account, so no action can be attributed. The whiteboard password lets anyone at the desk, including a visitor, read patient reports.
- Unsafe channels: emailed Word files and WhatsApp PDFs leave the laboratory's control. A wrong recipient or a lost phone becomes a confidentiality breach.
- Backup that is not a backup: a USB drive and a technician's personal laptop at home are unencrypted, unmanaged and probably connected during the infection. The laboratory discovered the loss only the next morning. Paying a ransom recovered three files but proved nothing about the rest.
- Single point of failure: one reception PC holds the working copies. Ransomware on that PC encrypts everything the staff use.
Priority: first make a tested, offline or immutable backup; then separate accounts and add multi-factor authentication; then endpoint protection and email filtering; then a patient-data handling rule. Without the first, every other control still leaves the laboratory unable to recover.
2. Propose a practical set of controls that six staff can follow during clinic hours. Distinguish 'must do this week' from 'within three months'.
Read the worked answer
This week (must do):
- Disconnect the infected PC from the network, preserve it for evidence, and change the Gmail and Windows passwords from a clean device. Enable multi-factor authentication.
- Create a 3-2-1 backup: three copies, two media, one offline or immutable. Test a restore of a random report before trusting it. Do not keep the USB drive permanently connected.
- Stop sending reports from the shared Gmail account; use individual accounts or a secure portal. If WhatsApp must continue, use it only with patient consent, send no identifiable file name, and delete after confirmation.
- Give each staff member a separate login with the least access needed. Remove the whiteboard password.
Within three months:
- Encrypt the reception PC and any portable drive; use a clinic-owned NAS with versioned backups, not a personal laptop.
- Add managed endpoint protection, email attachment filtering, patching and disabled macros.
- Write a one-page incident and data-handling procedure, train staff, and nominate one data guardian. Keep a register of breaches and near misses.
- Review retention and deletion. Test the restore monthly and record the result. These steps fit clinic hours because they are scheduled, not improvised.
3. Discuss the ethical and legal issues raised by paying the ransom and by using WhatsApp for reports. What should the laboratory tell patients?
Read the worked answer
Paying the ransom raises ethical and legal concerns even when it seems practical. It funds criminal activity, does not guarantee recovery, and may encourage further attacks. Some jurisdictions restrict or prohibit payments to sanctioned groups, and the laboratory may have a duty to report the incident. The decision should be documented and made with legal advice, not by the technician alone.
WhatsApp is encrypted in transit, but the report still lives on the patient's and the staff member's phones, and a wrong number is easy to dial. Sending a report this way without consent can breach confidentiality. The laboratory should offer a secure portal or encrypted email, obtain consent for any messaging channel, send the minimum necessary, and verify the recipient.
Tell affected patients promptly and plainly: what data was involved, when, what has been done, what they should watch for, and whom to contact. Do not hide the incident. Notify the relevant authority as required, document the decisions, and offer a practical remedy such as credit monitoring only if relevant. The ethical duty is transparency and care, not protecting the laboratory's reputation.