Ransomware in a Diagnostic Laboratory: Backups, Ransom and Patient-Data Leakage
Lanka Care Diagnostics is a private laboratory in Colombo with 60 Windows workstations, one file server and a NAS holding eleven years of patient reports. All staff sign in with a shared account, labuser (password Lab@123, unchanged since 2019), because the lab manager believes per-user logins slow shift changes. The NAS uses RAID 5 with two 4 TB disks. The only backup is a scheduled script that copies the NAS share to a USB 3 TB drive at 23:00 every night; the drive sits on top of the NAS and is overwritten each night. On Monday morning staff find every report file renamed with a .lock3d extension and a ransom note demanding USD 1,500 in Bitcoin. The USB drive is also encrypted. While investigating, the IT officer learns that a receptionist had been emailing monthly patient reports to her personal Gmail account to work from home, and that a former employee's account is still active six months after leaving. The laboratory must resume reporting within 24 hours and is subject to Sri Lanka's Personal Data Protection Act No. 9 of 2022.
1. Map the laboratory's control failures to the confidentiality, integrity and availability of patient data, and design a replacement backup scheme that meets RPO ≤ 1 hour and RTO ≤ 8 hours. Justify each element, including why RAID 5 was never a backup.
Read the worked answer
Failures, mapped:
- Availability: the only copy of the backup was online, in the same room, on the same network share, and overwritten nightly. One event destroyed both the primary and the copy. RAID 5 protects against a single disk failure only; it mirrors the damage instantly because the corruption was logical (files encrypted through the OS), not physical. RAID is an availability feature for hardware faults, never a recovery mechanism for data loss.
- Confidentiality: the shared labuser account means no action can be attributed to a person, and one credential compromise gives access to eleven years of reports. The live former-employee account is a standing entry point. Both violate least privilege and accountability.
- Integrity: no offline or immutable copy existed, so there was no known-good state to compare against or restore.
Replacement design, against genuine 3-2-1 rules:
- Three copies, two media, one offsite. Nightly full plus hourly incrementals to a second NAS in a different building, and a monthly archive to encrypted cloud object storage or a rotated set of removable drives taken home by two different officers.
- Immutability / offline. Use object-lock or WORM storage, or physically disconnect the removable drive. A backup that the server can write to with normal credentials will be encrypted in the next attack; the backup account must not be an administrator on the production domain.
- RPO ≤ 1 hour requires hourly incremental snapshots, not a nightly copy; losing at most an hour of reports is a business decision the lab must accept explicitly. RTO ≤ 8 hours requires that a bare-metal or image-level restore of the file server be rehearsed, with a documented runbook and tested restore of a sample folder each quarter - an untested backup is a hypothesis.
- Retention and separation of duties: GFS retention (daily 30, monthly 12) so an intrusion that sits undetected for weeks can still be outrun, and restore rights held by someone other than the daily administrator.
The test of the design is not the schedule but the last successful restore.
2. Advise management on whether to pay the ransom, and on their legal and ethical obligations now that patient data is affected. Justify your reasoning rather than listing obligations.
Read the worked answer
On paying: recommend against, on three independent grounds. First, effectiveness: the USB copy is also encrypted, so the only recoverable data is whatever can be rebuilt; paying for a decryption key from an unknown party has no guarantee of delivery, and the tooling frequently fails on large files. Second, risk: payment identifies the lab as a paying target, funds criminal activity, and in some jurisdictions engages sanctions or anti-money-laundering rules, so it is a legal question for counsel, not a technical one. Third, principle: the lab's real obligation is to restore service and protect patients, and money spent on a key is better spent on clean infrastructure, forensic support and the controls in the previous task.
Legal and ethical obligations. Under the Personal Data Protection Act No. 9 of 2022, a controller that suffers a personal-data breach must notify the Data Protection Authority and, where the breach is likely to result in a risk to data subjects, the affected individuals - the reasoning being that patients need to know their HIV status, fertility or oncology reports may be in criminal hands, because that risk (discrimination, extortion) is theirs to manage and only they can watch for it. Reporting to Sri Lanka CERT and making a police complaint under the Computer Crimes Act No. 24 of 2007 (unauthorised access and damage to a computer) is the counterpart criminal step.
Ethically, the lab should not conceal the incident to protect reputation: patients' interests come first, and a quiet restore plus silence converts a technical failure into a breach of trust. Operationally: preserve evidence (disk images, logs) before wiping and rebuilding, because destructive clean-up destroys the investigation, and communicate a single factual statement rather than speculation about who is responsible.
3. The receptionist emailed reports to a personal Gmail account and a former employee's account still works. Analyse these as security incidents in their own right and propose the specific technical and policy controls you would put in place, distinguishing controls that prevent from those that detect.
Read the worked answer
These are not side issues; together they are more damaging than the ransomware, because they are confidentiality failures that no backup can undo. Eleven years of reports in a personal mailbox is a disclosure to a third-party processor with no contract, no retention limit, and no ability to delete on request. A live account for a leaver is an unauthorised-access path that the shared labuser practice would have hidden anyway, since logs cannot show who was at the keyboard.
Preventive controls:
- Retire labuser; issue individual named accounts with role-based access so a receptionist can see appointment data but not clinical results. This is the single change that makes every later control possible, including attribution in logs.
- A documented joiner-mover-leaver process: disable the account on the last working day, recover devices and tokens, and have HR trigger it - the failure here is a process failure, not a technology one.
- Block personal webmail and unsanctioned cloud storage at the gateway for clinical workstations, and provide an approved, logged way to work remotely (VPN plus a clinical portal) so staff are not forced to improvise.
- DLP rules that alert on patterns matching report identifiers leaving by email or USB.
Detective controls:
- Centralised logging and alerting on bulk file access, unusual outbound email volume and logins from new geography or at unusual hours.
- Quarterly access reviews and an automated report of accounts that are enabled but have not logged in for 30 days.
Policy and legal: an acceptable-use policy with a clear disciplinary consequence, mandatory annual confidentiality training, and a GDPR-style breach register so this incident is recorded, assessed and, if the risk threshold is met, notified. The test of the policy is whether it names who may approve an exception, because the receptionist almost certainly believed she was being helpful.