Ransomware at a regional hospital: when is an incident reportable?
A Dutch regional hospital with 2,400 employees and 18,000 inpatient admissions per year detects ransomware at 08:40 on a Saturday. The electronic health record system is unavailable for six hours; clinicians revert to paper. The attackers exfiltrated 8,500 patient records, including names and treatment codes, and demand €400,000. The hospital's backups were immutable and restoration is complete by 21:00 the same day. No surgeries are cancelled, but two outpatient clinics are delayed by a day. The hospital's CSIRT contact is known. The CISO wants to wait until the forensic firm confirms the initial access vector before notifying anyone. The hospital is an essential entity under NIS 2 in the health sector.
1. Is this a significant incident, and what reporting deadlines apply from the moment of awareness?
Read the worked answer
It is very likely a significant incident. The electronic health record was unavailable for six hours, which is a severe operational disruption for a hospital, and 8,500 patient records were exfiltrated, creating potential material and non-material damage for patients. The hospital is an essential health entity. Awareness arose at 08:40 on Saturday, so the early warning should go to the CSIRT or competent authority within 24 hours, by 08:40 on Sunday. The incident notification should follow within 72 hours, by 08:40 on Tuesday. The final report is due within one month. The CISO's proposal to wait for confirmation of the initial access vector is not acceptable for the early warning: NIS 2 allows notification on the basis of suspicion, with later updates if facts change.
2. What should the early warning and the 72-hour notification contain, and what can reasonably be left to the final report?
Read the worked answer
The early warning should state that a significant incident is suspected, whether it is suspected to be malicious, whether cross-border impact is suspected, and provide contact details and an initial impact assessment. It should not speculate beyond known facts. The 72-hour notification should update the severity and impact, describe indicators of compromise, the initial root cause if known, mitigation measures taken, and any cross-border impact. It can be preliminary. The final report should provide a detailed description, root cause, applied and ongoing mitigation, cross-border impact, and lessons learned. Patient-level details should be limited to what is necessary and handled securely. The hospital should preserve logs and evidence because supervisory authorities may ask for them.
3. How should the hospital handle GDPR obligations and internal governance alongside the NIS 2 report?
Read the worked answer
NIS 2 reporting does not replace GDPR obligations. Because personal data were exfiltrated, the hospital must assess whether the breach requires notification to the data protection authority within 72 hours and communication to affected patients where there is a high risk to their rights and freedoms. The NIS 2 report and the GDPR notification serve different purposes and may contain different details. Internally, the management body should be informed promptly, approve the incident response and communication plan, and ensure the CISO has authority to act. The hospital should also review why the CISO considered delay acceptable and fix the escalation policy. Paying the ransom should not be treated as a compliance shortcut; it is a separate risk and legal decision.