An illustrative case explaining the route

Patient records and the imaging archive encrypted in a clinic group

A multi-speciality clinic group. The medical records system and the imaging archive run on a single storage unit, and the nightly copy is written to a folder on that same unit. When the unit was encrypted, booking and consultation stopped together, and clinicians could see neither a patient's history nor their previous images.

Start free assessment

Health & care

What was affected

  • The medical records system and its database.
  • The imaging archive on the same storage unit.
  • The booking and appointments system.
  • The nightly copy folder inside the unit.

What had been tried before it reached us

  • Trying to open images from a clinician workstation to see whether they were intact.
  • Restarting the storage unit several times.
  • Copying whatever looked intact onto a USB stick and working on it directly.

The route

  1. 01

    Continuity of care first

    Before any technical work, a paper procedure was brought up for appointments and critical prescriptions, because downtime here touches patient safety, not only revenue.

  2. 02

    Isolating and imaging the unit

    The storage unit was disconnected and imaged, and every later read ran against that image.

  3. 03

    Separating the records database from the images

    Each has a different route: a database has a transaction log, while an imaging archive is separate files in standard formats.

  4. 04

    Assessing obligations early

    Assessment of whether the incident touched personal data began alongside the technical work, not after it.

  5. 05

    Recovery ordered clinically

    Recovery was ordered by who had an imminent appointment and whose case was active, not alphabetically or chronologically.

The outcome

What came back

  • The medical records database from an older nightly copy written to a second destination.
  • Most of the imaging archive from a storage-level snapshot.
  • The booking system, rebuilt from the recovered database.

What did not

  • A full day of images between the last snapshot and the incident.
  • Clinician notes entered in the final hours before encryption.
  • Attachments of external reports uploaded the same day.

What would have changed the outcome

  • A second backup destination outside the storage unit holding the data.
  • Shorter snapshot intervals for the imaging archive specifically.
  • A written and rehearsed paper procedure for appointments and prescriptions during downtime.
  • Readiness in advance to assess personal-data notification obligations.

Next step

Start free assessment

Isolate the device and keep the ransom note.

Send the file extension, the ransom note and a description of the affected devices. We assess the case without inaccurate promises.