Ransomware at Mercy Vale Regional Hospital
At 02:40, Mercy Vale Regional Hospital, a 420-bed facility with six outpatient clinics, loses its electronic health record to ransomware. Ambulance diversion begins at 03:05; 14 elective surgeries are postponed; staff revert to paper forms. The ransom note gives 72 hours and claims 80 GB of patient records were copied, but the hospital has not verified exfiltration. At 06:00 a reporter calls asking whether patient data was stolen and whether the hospital paid. The privacy regulator requires notification within 72 hours of becoming aware of a personal data breach where risk is likely. The board chair wants to describe the event only as an IT outage and avoid the word ransomware. Clinical leaders need to tell 1,100 staff what to say to patients. The hospital has a pre-approved cyber incident annex, a 24/7 call center and no dedicated security spokesperson.
1. Draft the first external holding statement and state when it should be issued.
Read the worked answer
Issue a short statement by 07:30, after internal clinical and legal sign-off, because media already know systems are down and silence will be filled with speculation. Content: confirm a cybersecurity incident affecting some IT systems; state patient safety comes first and that ambulance diversion and postponed procedures are precautionary; say clinical care continues on backup processes; acknowledge an investigation with external experts and regulators; commit to updates at fixed intervals. Do not speculate on data theft, ransom payment, or attacker identity. Avoid the phrase 'nothing to worry about.' Include a phone line for patients whose appointments are affected. The statement should be attributed to the CEO or incident commander, not an anonymous IT desk. Issue it on the hospital website and social channels, and send the same text to the reporter who called. This meets the 72-hour regulatory clock while preserving room to update.
2. The board chair wants to avoid the word ransomware. How should the hospital handle terminology and the unverified data exfiltration claim?
Read the worked answer
Terminology should be accurate but not speculative. If the incident has the technical characteristics of ransomware, calling it only an IT outage is likely to be seen as misleading once investigators or journalists confirm encryption and a ransom note. A defensible formulation is 'a cybersecurity incident involving unauthorized access and encryption of some systems, which we are treating as a ransomware incident.' That does not require naming the attacker or payment. For exfiltration, say 'we have not yet verified whether patient data was copied; we are investigating with forensic experts and will notify affected individuals and the regulator as required.' Do not repeat the 80 GB figure as fact. Prepare a Q&A that distinguishes confirmed, unconfirmed, and unknown. Legal privilege should guide what is withheld, but privilege is not a public denial. The chair should be briefed that a later correction is more damaging than an early, carefully bounded admission.
3. What should be communicated to staff and patients, and in what order?
Read the worked answer
Staff first, before the public statement, because 1,100 employees will otherwise learn from media and improvise. Give them a 15-minute huddle script: what is confirmed, what to tell patients, how to report errors in paper processes, and where to escalate. Emphasize that no one should discuss ransom, attacker identity, or patient data. Patients next: use the call center and clinic staff to explain delays, diversion, and how records are being protected; provide a written handout. Do not send a mass patient email before the facts on data access are clearer, because it may alarm without actionable advice. Regulator notification follows the legal risk assessment within 72 hours. Media gets the holding statement. Sequence matters because employees are both an audience and a channel; if they are uninformed, the patient message will fail.