Ransomware containment for a regional hospital

The Challenge

The hospital faced an active ransomware outbreak encrypting clinical systems and backups, demanding rapid containment and the safe restoration of patient care.

Key Issues:

• Encrypted clinical systems
• Backups reachable from production
• No tested recovery runbook
• Limited overnight endpoint visibility

The Solution

We contained the outbreak, rebuilt clean domain infrastructure, and restored clinical services from isolated, verified backup copies.

Key Actions:

• Rapid isolation of infected hosts
• Clean rebuild of the domain controller estate
• Immutable, air-gapped backup architecture
• Tested clinical recovery runbooks

In healthcare, downtime is measured in patients, not hours. Recovery has to be rehearsed long before the first encrypted file appears on a screen.

Compliance & Risk Management

Healthcare providers carry both patient safety and regulatory obligations when systems fail. Our recovery programme documents every containment decision and restoration step, giving HIPAA auditors a defensible record while clinicians regain access to care systems.

• Healthcare providers carry both patient safety and regulatory obligations when systems fail.
• Backup Integrity & Testing – Immutable copies verified against restoration targets.
• Incident Response & Forensics – Root-cause analysis and documented containment steps.
• Endpoint Detection & Response – Behavioural blocking across clinical workstations.