Ransomware in a Hospital Imaging Network

Isolate the PACS VLAN and the affected archive servers, not the whole hospital network. Full shutdown would also take down badge access, pharmacy dispensing, and lab interfaces, creating immediate patient-safety harm; the EHR is SaaS and unaffected, so it should stay up. Move radiology to the 4-hour paper downtime procedure, notify clinical leadership, and divert or reschedule non-urgent imaging if the archive cannot be restored quickly. At the same time, disable the domain-joined backup server from the domain, block known C2 indicators, and preserve the ransom note, encrypted files, and logs. Check domain controllers and backup infrastructure for compromise because the note claims backups were deleted. The decision should be driven by the minimum set of systems that must be isolated to stop spread, while keeping clinical workflows running. If evidence shows domain-wide compromise, escalate to a broader isolation, but do not start there without that evidence.

Compare the two backup sources. The online backup is only 2 hours old but sits on a domain-joined server with an online share, so it may be encrypted, deleted, or poisoned by the attacker. The offline backup is 36 hours old but is more likely intact. Restore the offline backup first into an isolated recovery environment, validate the archive and malware-scan it, then restore to production. If the online backup is immutable and its catalog is intact, test it in isolation; do not assume it is good because it completed 2 hours before encryption. Paying 35 BTC is not justified while a plausible restore path exists: payment does not guarantee a working decryptor, funds criminal activity, and may create sanctions or legal issues. The 36-hour data loss is a clinical decision; radiology images can often be reacquired, but urgent studies may need to be repeated. Document the risk and let clinical leadership decide on diversion.

Activate the incident response plan and a command structure with separate security, clinical, and communications leads. Notify legal, the cyber insurer, law enforcement, and the PACS vendor; preserve evidence before rebuilding. Determine whether patient data was exfiltrated, because notification duties may apply. Communicate with clinicians in plain language: what is down, what the downtime procedure is, and how to report issues. Rebuild affected systems from trusted media, reset privileged credentials, and consider KRBTGT reset if domain compromise is confirmed. Restore in phases: PACS first in an isolated VLAN, then reconnect only after monitoring. Do not reconnect the old backup server until it is rebuilt. After recovery, review segmentation, backup immutability, domain-joined backup design, and endpoint detection. The CISO’s desire to pay should be documented as considered and rejected for now, with a clear trigger for revisiting if restoration fails.