Ransomware at the Subsidiary Clinic

Order: protect clinical safety and confirm diversion or paper procedures; isolate affected network segments and disable compromised accounts, but do not power off servers, because volatile memory and encryption keys may be needed; preserve evidence - capture memory, image at least the domain controllers, file server, and virtualization hosts, and export EDR, DNS, proxy, and VPN logs; notify legal, privacy, insurer, and executive leadership and activate the incident response plan; determine scope and whether the cloud backup repository or identity systems are compromised; then begin a clean rebuild in an isolated environment. Before any host is reimaged, forensic images must be taken and hashed, chain of custody documented, and legal's preservation notice acknowledged. Reimaging destroys evidence and can also destroy indicators needed to confirm whether the attacker still has persistence elsewhere. Do not restore over production until the clean environment and credential reset are ready.

Treat the NAS as suspect. It is domain-joined and in the same building, which is exactly what ransomware crews target; restoring from it could reintroduce the payload or restore encrypted data. Use the immutable cloud copy, but recognize the six-day gap violates the four-hour RPO. Validate before production: restore into an isolated, non-domain-joined environment; scan with current signatures and EDR; verify application and database consistency; check for persistence, scheduled tasks, and rogue accounts; confirm hashes against the backup catalog. Rotate all credentials, including service accounts and backup credentials, before reconnecting. Rebuild domain controllers from known-good media rather than restoring them from potentially compromised backups. Document the data-loss window and have clinical and billing owners reconcile manually. Then restore in dependency order: identity, core infrastructure, scheduling, billing. If the cloud copy is also affected, fall back to the NAS only after forensic validation.

Payment: the CEO and board, with legal, insurer, and law enforcement input; the incident commander advises but does not decide. Factors: sanctions screening of the wallet, whether decryption keys work when tested on a sample, whether the data has already been leaked, and whether paying creates legal or regulatory exposure. Do not pay merely to meet the 72-hour deadline, and assume the stolen data may be leaked regardless. Notification: counsel makes the legal determination, but the decision should be documented. The 30-day state deadline likely controls over HIPAA's 60 days. Notify individuals, HHS/OCR, and media if thresholds are met; do not wait for a perfect forensics report if the delay pushes past the state deadline. The 18,000 patients are identifiable now. The clinic director does not decide notification or payment.