Ransomware at a 250-bed private hospital · full recovery within 48 hours
A private hospital in Anatolia was hit by a Conti variant at 23:00 on a Friday. 1,200 endpoints were encrypted · the HIS · PACS · LIS systems went offline. The emergency department ran on pen and paper for 30 hours. DSET recovered all systems in 48 hours.
01 The Challenge
At 23:14 on Friday the HIS terminals froze with the message 'Your files are encrypted.' The PACS server offline · radiology images inaccessible · LIS lab results not coming in · the pharmacy system down. Because the patient database was unreachable, new admissions began to be taken on paper forms. Previous test results of critical patients in the emergency department could not be seen. This was not a vital crisis · it was the starting point of a vital crisis.
02 DSET's Approach
T+0 · Triage
The DSET incident response team made phone contact in 47 seconds. It was confirmed within 18 minutes via IOC matching that it was a Conti variant. The affected systems were taken offline · the spread was stopped.
T+4h · On site
Together with the hospital's technical team, in the first 4 hours forensic image collection · network isolation · identification of the attack source (RDP brute force, then a Cobalt Strike beacon).
T+12h · Backup analysis
The backup chain was checked for the PACS archive · HIS DB · LIS results. The last full backup was 9 hours earlier · the attacker had tried to corrupt it too but could not finish.