The attack destroyed domain controllers and most workstations overnight. Clinical systems stayed up because they lived on a separate network that an engineer had insisted on years earlier. Recovery ran on paper, pre-staged golden images and a lot of pizza.
What worked
Offline backups, printed runbooks and a vendor contact list stored outside the network. What did not: the assumption that the identity provider would be available. Every recovery step that needed a login had to be redesigned on the fly.
Key takeaways
- Network segmentation kept clinical systems running
- Identity dependencies stalled early recovery
- Printed runbooks earned their place
This story is part of our ongoing coverage of cybersecurity. We will update it as more details emerge.
