mythsthe wider recordAscension2024healthcare and hospital operations

everyone assumed:

hospitals can keep running normally through an IT incident

what was actually true:

A hospital can keep treating patients through an IT incident, and doing so for six weeks is a different thing than doing so for an afternoon.

how it happened

  1. whoBlack Bastaransomware group
  2. the gapone workstationan ordinary mistake
  3. thencore systemshealth record offline 6 weeks
  4. the result140 hospitals5.6M patients exposed
the gap that let it happen the result

what everyone assumed

A hospital is the archetype of a place that runs through anything, so it is natural to assume an IT incident is one more thing the building absorbs while care continues unchanged. The reasonable belief is that clinicians can fall back to paper for a shift, the way they always could, and that the digital layer is a convenience rather than a load-bearing part of treatment. Modern care has quietly grown more dependent on that layer than the assumption accounts for.

what happened

The intrusion, attributed to the Black Basta group, is reported to have begun when a file was opened that should not have been, an ordinary mistake of the kind any of us could make on a busy day. From there the attackers moved through the environment, and core systems began to fail. Across roughly 140 hospitals in 19 states and Washington DC, the electronic health record went down. Staff returned to paper charts and manual medication checks. Some ambulances were diverted to other facilities. The fallback worked, and it was also slower, heavier, and more fragile than the system it replaced, for week after week.

step by step

  1. a file is opened that should not have beenReported as the start of an intrusion attributed to Black Basta.
  2. attackers move through the environmentCore systems begin to fail.
  3. the health record goes down at about 140 hospitalsStaff switch to paper charts; some ambulances are diverted.the assumption breaks here
  4. six weeks to restore5.6 million patients' data exposed and an operating loss of about 1.8 billion dollars for the year.

how it surfaced

It took about six weeks to restore the electronic health record and return to normal operations. The personal and health data of 5.6 million patients was confirmed exposed. Across its 2024 financial year, Ascension reported an operating loss in the region of 1.8 billion dollars, a decline attributed in part to the attack. The assumption retired itself somewhere in the fifth week of charting by hand, when “we can run on paper” had quietly become “we have been running on paper for over a month.”

A hospital can keep treating patients through an IT incident, and doing so for six weeks is a different thing than doing so for an afternoon.

The digital record is not a convenience layered on top of care anymore. It has become part of how care is delivered.

picture it at a company like yours

The company here is made up. The other two paths are not: they happened, and each links to the story.

your company
a normal dayYour whole operation runs on one core system: bookings, orders, records, scheduling.
the gap nobody seesThe fallback plan says 'we can work on paper', and nobody has tried it for more than an afternoon.one system with no plan B
  1. in this story
    the day it mattersRansomware takes the core system down and it stays down for weeks.
    what it costs youStaff work from paper for a month, everything is slower, and some customers simply go elsewhere.
  2. or it goes like this
    howYour main software vendor is hit and goes dark for two weeks.
    what leavessales, orders and invoicingwho ends up with itcompetitors, as customers go elsewhere
    it happenedCDK Global, 2024
  3. or it goes like this
    howBackups live where the attacker can delete them too.
    what leaveseverything, with nothing left to restorewho ends up with itthe business itself, which closes
    it happenedCode Spaces, 2014

sources

  1. Ascension Ransomware Attack Affects 5.6 Million Patients ,
  2. Ransomware attack on health giant Ascension hits 5.6 million patients ,
  3. Ascension confirms data breached in Black Basta ransomware attack ,
  4. AHA, H-ISAC warn hospitals about Black Basta following Ascension cyberattack ,

← all myths

your turn

what you can do about it

  1. this week

    Take your most critical operational system and ask how its way in is protected, then ask the harder question your continuity plan may not have answered: not whether you can switch to manual, but how long you can survive there.

    Think about the one system your team would fall back from if it disappeared this morning, and how long your fallback is actually designed to last. A workaround that is fine for an hour is a question mark at a week and a crisis at six. The Ascension story is about that second number.

  2. go deeper

  3. if you're not sure where to start

    Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.

    open the checklist →

the letter · every two weeks

one access gap in your inbox, with the fix.

Every issue takes one way access creeps in, shows a real incident where it went wrong, and ends with one thing to check that week. Written for the people who run the tools, without a security team behind them.

  • 1one mechanism, explained plainly
  • 2one real incident, taken apart
  • 3one step you can take on Monday

get the next issue

One email every two weeks. Your address stays here and is never passed to vendors. One click to unsubscribe. Privacy.