Ransomware at a Regional Hospital: Sorting the Ontology
A 220-bed regional hospital is recovering from a ransomware incident. The affiliate gained access through an unpatched VPN appliance, moved laterally, and encrypted the electronic health record (EHR) and imaging systems. EHR downtime lasted 11 days; backups restored in 5 days but were incomplete for the prior 24 hours. The hospital diverted ambulances for 3 days and cancelled 140 elective procedures. The ransom demand was $2.4M; the board has not decided whether to pay. Regulators may fine up to $1.5M, and notification is estimated at $9 per record for 40,000 records. Cyber insurance has a $1M deductible and a $5M limit. The draft risk register, written by the IT director, lists four items: (a) 'the EHR system' as the threat agent, (b) 'the ransomware group' as the asset, (c) 'unpatched VPN appliance' as the risk, and (d) 'the ransom payment' as the only loss. The CISO wants the register corrected before the board meeting.
1. Correct the four register entries using Open FAIR taxonomy, and explain the threat community versus threat agent distinction in this incident.
Read the worked answer
(a) The EHR system is an asset, not a threat agent. (b) The ransomware group is a threat community or threat agent, not an asset. (c) The unpatched VPN appliance is a vulnerability or control gap, not a risk; the risk is the scenario of an affiliate exploiting it to encrypt EHR and imaging systems. (d) The ransom is one loss form, at most a response or extortion cost, not the whole loss. The threat agent is the specific affiliate or intruder in this incident. The threat community is the broader group sharing motivation, capability, and targeting behavior, such as ransomware-as-a-service affiliates. Analysis usually uses the community because agent-specific data are unavailable and the community drives probability of action and capability. Correcting the register prevents the board from treating a system, a group, a missing patch, and one payment as if they were the same object.
2. Separate the incident's losses into primary and secondary loss and name the affected stakeholder for each. The CFO wants to use the $2.4M ransom as the risk estimate; explain why that understates the analysis.
Read the worked answer
Primary losses fall on the hospital: productivity from 11 days of EHR downtime, cancelled procedures, and ambulance diversion; response costs for forensics, negotiation, restoration, and notification; replacement of backup infrastructure or devices. The ransom, if paid, is a response or extortion cost and is often treated as primary loss. Secondary losses arise from other stakeholders' reactions: regulatory fines and judgments, reputation damage affecting patient trust and payer contracts, competitive advantage loss, and secondary response costs such as patients shifting care. The $2.4M ransom is one line, may not be paid, and is before the $1M deductible and $5M insurance limit. The analysis needs LEF and a loss magnitude distribution across forms, not a single known cost. Using the ransom alone ignores the larger operational and regulatory exposure and gives the board a false basis for the pay-or-not decision.
3. How does identifying the threat community as ransomware-as-a-service (RaaS) affiliates rather than hacktivists change TEF, vulnerability, and loss magnitude assumptions?
Read the worked answer
RaaS affiliates are financially motivated, use proven tooling, and target availability and extortion, often with double extortion through data theft. That supports a higher TEF because scanning and affiliate access are widespread, and a vulnerability estimate driven by exposed services and controls. Loss magnitude includes ransom, downtime, notification, and regulatory penalty. Hacktivists have different motives: they may deface, leak, or disrupt for attention, with lower probability of extortion and different targeting. Their TEF and loss magnitude assumptions would differ. The threat community informs probability of action, capability, and likely loss event, not just the label 'attacker.' The analyst should document why the chosen community fits the evidence and how the estimates would change under the alternative.