Ransomware in a healthcare practice: what happens in the first 72 hours?
The first hours are for stopping the spread, not for repairs: you unplug the affected devices from the network without switching them off, call your IT provider and run the practice on paper. Within 72 hours, you will normally have to notify the Data Protection Authority of the data breach. You should also file a police complaint as early as possible and check that your backups are clean, without paying the ransom. Full recovery comes afterwards, from clean backups.
The scenario in brief
Example, made up for illustration. A Monday, 7.50 am. The receptionist at a practice of four physiotherapists switches on the front-desk PC. The diary won't open. On the desktop, every file has an unfamiliar extension, and a document explains that you have to pay to get them back. The first patient is due at 8.
This is ransomware: malicious software that encrypts your files, meaning it makes them unreadable without a key that only the criminals hold. It has often copied data before locking it too, so the criminals can threaten to publish it.
Recovering fully from an attack like this takes time. But what you decide in the first few hours carries a lot of weight. Here, step by step, is what happens and what you do.
Hour 0 to 1: disconnect, don't switch off
The natural reflex is to switch the computer off. That is a mistake. You should not switch off the affected devices: shutting down can erase traces held in memory that help explain the attack. Isolate them, don't shut them down.
- Unplug the network cable from the affected computers and turn off their Wi-Fi. If you have any doubt about how far it has spread, unplug the practice's internet router.
- Leave them on, with the screen as it is. Take a photo of the ransom note with a phone.
- Unplug the backup drive if it is still connected to a PC or the network, so that it doesn't get encrypted too.
- Don't switch on devices that are still off (a laptop, a PC in a treatment room): they may be untouched.
- Start a paper log: the time, who did what, what you saw. You will need it for the police complaint, your insurer and the Data Protection Authority.
Then call your IT provider, by phone rather than by email. Treat the practice's email as possibly compromised and talk on a separate channel, for example a group in an encrypted messaging app, on your phones.
Hours 1 to 6: who to alert, and how
In a small practice, the 'crisis team' often comes down to two people: the practice owner and the IT provider. What matters is that everyone knows who calls whom. Your first port of call is your IT provider.
| Who | Why | How |
|---|---|---|
| Your IT provider | Isolate the network, preserve the traces, assess the extent | By phone, number written down on paper |
| Your insurer | Find out what the policy covers before you commit to any costs | Policy number to hand |
| The local police | File a complaint: the attack is a criminal offence | At the police station, with photos and the log |
| The practice team | One version of the facts, no tinkering | A ten-minute stand-up, written instructions |
Know what to expect: according to its incident reporting page, the address [email protected] is reserved for organisations that are victims, and a reply from an operator is not guaranteed: it depends on how serious the incident is. The emergency number is reserved for entities covered by the NIS2 Directive (the European law that sets cybersecurity rules for essential sectors, including some healthcare providers). Your first port of call is your IT provider.
On the insurance side, check whether incident response is part of your policy. Call before you sign a quote for any intervention: the policy states what will be covered, and on what terms.
Hours 6 to 24: assess the damage and keep seeing patients
Rebuilding is not the first step. First you need to know what has been encrypted and what may have been copied. Your IT provider will try to answer four questions.
- Which devices are affected? Just the front-desk PC, or also the server that holds the patient records?
- What data was on them? Diary, medical records, accounts, copies of identity cards.
- Has any data left the building? Criminals often copy before they encrypt, to put on pressure.
- Are the backups intact? This is the question that decides everything else.
On that last point, everything depends on an independent, checked copy of your data that the attacker could not reach: if it exists, that is what you restore from. Hence the value of so-called immutable backups, which cannot be changed or deleted for a period set in advance.
Running the practice on paper
Meanwhile, patients keep arriving. Switch to a fallback mode: rebuild the day's appointment list from the reminders you sent or from your phones, use paper forms for session notes, and postpone anything that isn't urgent. If your patient record software is hosted online and has not been affected, only log in to it from a device your IT provider has declared clean.
Communicate early, starting with the team, then partners and the patients concerned, with a short message: what you know, what you are doing, and when you will give an update.
Hours 24 to 72: the legal obligations
Ransomware at a practice is almost always a personal data breach under the GDPR. The European Data Protection Board explicitly puts data made unavailable through encryption by ransomware in this category, even if nothing has been stolen.
| Obligation | Deadline | Where |
|---|---|---|
| Notify the Data Protection Authority (DPA) of the breach | Without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the risk to people is unlikely | The DPA's online portal (notifications by email are not processed) |
| Inform the patients concerned | Without undue delay, if the risk to them is high | Letter or message, in plain words |
| Document the incident internally | Always, even without notification | The practice's breach register |
| File a police complaint | As early as possible | Local police |
You can notify in several stages: the GDPR (Article 33) allows the information to be provided in phases. A first notification with what you know, then additional details. The procedure is described on the DPA's page on personal data breaches (in French).
What about the ransom?
Don't pay. As the No More Ransom website points out, there is no guarantee you will get the decryption key, and paying shows the criminals that their method works. Paying doesn't wipe out your obligations to the DPA and your patients either.
Keep a copy of the encrypted files: a free decryption tool for your ransomware may appear later. No More Ransom publishes new ones regularly.
After 72 hours: rebuild without reinfection
Once the extent is known and the backups have been checked, getting back up and running follows a set order.
- Change all passwords, starting with administrator accounts, and turn on multi-factor authentication: a code sent to your phone on top of the password.
- Reinstall the affected devices completely, updates included, rather than trying to 'clean' them.
- Restore the server first, then the workstations, from a backup made before the attack and checked clean. Never from a backup made just before or after it, which could contain the intruder.
- Reopen internet access gradually, starting with the computers you need to get back to work.
- Find out how the attacker got in (a phishing email, poorly protected remote access, out-of-date software) and close that door before moving on.
What you can prepare from Monday
The first 72 hours go much better when you have prepared for them. Five steps that take hardly any effort:
- A paper emergency sheet kept at reception: numbers for your IT provider and insurer, your policy number, the police station, the address of the DPA's portal.
- A restore test: ask your IT provider to recover, in front of you, a patient record from a month ago.
- At least one offline or immutable backup copy, out of reach of an intruder who has taken control of the network.
- A paper fallback ready to go: blank session forms, and the next day's diary exported every evening and locked away.
- A thirty-minute drill with the team: 'The screen shows a ransom note. What do we do?'
To go further on the obligations, the European Data Protection Board's guide for small businesses explains in plain terms what a data breach is and when to notify it.
Prepare your practice for ransomware→
Frequently asked questions
Should you switch the computer off if you're hit by ransomware?
No. Switching off can erase traces held in memory that help explain the attack. Isolate the affected devices instead: unplug the network cable and turn off Wi-Fi, then call your IT provider.
Should you pay the ransom?
No. There is no guarantee you will receive a key that works, and paying shows the criminals that their method works. If you have an independent, checked backup, restore from it. Keep a copy of the encrypted files: a free decryption tool may appear later, for example on the No More Ransom website.
Is ransomware a data breach you must report to the DPA?
In principle, yes. Data made unavailable by encryption is a personal data breach under the GDPR, even if nothing was stolen. It must be notified to the Data Protection Authority through its portal, without undue delay and, where feasible, within 72 hours, unless the risk to people is unlikely. In every case, the incident must be documented internally.
Do you need to tell patients?
Yes, if the breach is likely to result in a high risk to them, for example if medical records may have been copied. They must be informed without undue delay, in plain words: what happened, which data is involved, what you are doing and what they can do.
How long does it take to recover from ransomware?
The first 72 hours are for isolating, alerting, assessing the damage and meeting the legal obligations. Rebuilding comes afterwards, from clean backups. How long it takes depends mainly on one question: do you have a clean backup, out of the attacker's reach? Without one, recovery becomes long and uncertain.
Who should you alert after a ransomware attack in Belgium?
First your IT provider, then your insurer. File a complaint with the police, and notify the Data Protection Authority of the data breach, through its portal, if personal data is affected.