Providing ransomware resilience to a healthcare organisation.

A major ransomware attack on the wider health service had already had some impact on the hospital. However, months later, the hospital suffered its own ransomware attack, resulting in the encryption of their servers. Rather than negotiating with the attackers, the hospital opted to handle the recovery process internally. With a dedicated effort from all teams, it took three and a half months to fully restore all services. This recovery was gradual, with departments coming back online step by step, but full functionality across all areas was only achieved after this period.

The team at the hospital had already identified several areas in their systems that needed improvement, and a network infrastructure refresh was planned. However, this was delayed due to the earlier ransomware attack on the health service, creating a window of opportunity for cybercriminals to strike. The attack on the hospital occurred just as the team were preparing for the holiday season. With health service staff still working seven-day weeks for the past six months to recover from their own cyberattack, they were only able to provide limited support.

The ransomware attack on the hospital occurred while the health service staff were still working seven-day weeks recovering from a previous cyberattack.

Following the earlier attack on the health service, stringent security protocols were introduced to prevent future breaches. These included wiping and rebuilding every end-user device from scratch. Once the data was verified as clean, it was migrated to a separate, secure network. Additionally, all servers underwent thorough low-level analysis, requiring between 30-50 hours of manual scanning overseen by the health service’s security partner. This rigorous process contributed significantly to the lengthy recovery time.

Simultaneously, the hospital upgraded its network infrastructure, implementing a new IP system so that only rebuilt devices could connect to the clean network, fully isolated from any potentially compromised systems. Post-attack investigations pointed to the VPN as the likely entry point for the breach. However, since the VPN files were destroyed during the attack, the hospital cannot confirm this with absolute certainty.

“It’s important to focus not just on protection, but on response, recovery and how resilient you are to a cyber-attack, rather than how protected you are.”

ICT Manager at the hospital

After the attack was resolved and normal operations resumed, the focus shifted to overhauling the network. Since the network’s vulnerabilities had already been identified, documented, and communicated, a plan was in place, along with the necessary funding, to address them.

Adopting a “security-first” approach aligned with NIS and NIS2 standards, the implementation of new infrastructure brought about significant improvements across the organisation. For example, two-factor authentication (2FA) was rolled out organisation-wide for email access, and the added security layers were met without resistance. To build a robust final layer of protection, the hospital consulted with trusted reseller partners and other hospitals.

One solution that repeatedly stood out was Helm’s ransomware containment. Interest in Helm grew further upon realising the hospital had strong auditing and alerting systems but lacked a way to stop malicious actors who managed to bypass the initial preventative solutions. Helm was then integrated into the hospital’s security stack. As the hospital put it at the time, “It’s in place as a security safety blanket, our last line of defence.”

With their overhauled and improved network infrastructure, NIS certified support tool and 2FA in place, the hospital was better prepared to face the actions of bad actors, and with Helm’s ransomware containment installed, it had built-in resilience against future ransomware threats.