🏥 Healthcare Ransomware — India

Ransomware — Indian Healthcare Scenario

AIIMS-level ransomware attack on a 12-hospital chain. Clinical operations continuity, patient safety decisions, MoHFW + CERT-In reporting, and the ransom decision under Indian law.

📋 Scenario Brief

Organisation

Medivision Health Network — 12 hospitals across 5 states, 6,200 staff, 2.4 lakh patient records

Sector

Healthcare (MoHFW regulated, ABDM participant)

Ransomware

LockBit 3.0 variant — confirmed human-operated, not automated

Initial Access

Phishing email to HR department 11 days prior — RDP credential harvested

Affected Systems

Hospital Information System (HIS), PACS (radiology images), billing, lab results, pharmacy

Patient Exposure

340 patients currently admitted across 12 hospitals. 8 ICU patients on digital monitoring.

Opening Situation

It is 6:47 AM on a Monday. On-call IT staff reports all servers across the network are unreachable. Staff arriving for the morning shift find workstations displaying a ransom note. The Hospital Information System is offline. ICU staff are switching to manual monitoring. The morning surgery schedule — 14 procedures — begins in 1 hour 13 minutes. Three patient deaths have been linked to hospital ransomware attacks internationally. Your phone is ringing. The Medical Director is asking what to do about the 6 AM surgery.

⏱️ Incident Timeline

T+0 — 6:47 AMMass Encryption Detected

All 12 hospital HIS servers offline simultaneously. Ransom note on workstations: "Your network is encrypted by LockBit 3.0. To restore, visit [.onion address]. ₹4.2 crore in Bitcoin. 72 hours. After that, 2.4 lakh patient records published."

Inject — Medical Director: "I need an answer in 5 minutes. Do I cancel the 8 AM surgeries or proceed manually? The anaesthesiologist says he cannot access patient allergy history. The HIS has the pre-op assessments."

T+20 minBackup Status — Critical Finding

IT: Backup server also encrypted. Offsite tapes exist — from 3 months ago. Restoring from tape means losing 90 days of patient records including recent prescriptions, lab results, and treatment notes.

Inject — ICU Nurse: "One of our ICU patients — bed 4, post-cardiac surgery from Friday — his medication schedule and dosing history is only in the HIS. We have a handwritten chart but it only goes back 12 hours. His next medication is due at 7:15 AM and the dosage has changed twice since admission."

T+45 minScope Expands

PACS (radiology image system) offline — radiologists cannot read X-rays or CT scans. Lab Information System offline — lab results cannot be reported electronically. Pharmacy management system offline — dispensing must be manual.

Inject — Casualty Department: "We have a RTA (road traffic accident) patient coming in — ETA 8 minutes. Trauma team needs CT imaging. PACS is down. We also have no blood bank system access. Can you restore at least the trauma systems?"

T+2 hoursMedia & Regulatory

National TV has picked up the story. A patient's family member tweeted a photo of the ransom note on a hospital computer screen. MoHFW has called asking for a status update. Staff are asking management whether it's safe to use any hospital computers.

Inject — MoHFW Secretariat: "We are aware of reports of a cyber incident at your facilities. As an ABDM participant, you have obligations regarding the security of health data. We need a written situation report by 12 PM today and will be sending an inspection team tomorrow. Is there any risk to the National Health Records of affected patients?"

T+4 hoursThreat Actor Contact

An email arrives to the CEO's personal address (indicating prior reconnaissance): "We have been monitoring your network for 11 days. We have exfiltrated patient data before encrypting. We have the complete records of your VIP patients including those from [names two prominent individuals by first name]. We are willing to negotiate. Your cyber insurance policy number is [correct number]. Contact us now."

Inject — Cyber Insurance Broker: "I've been trying to reach you. Your policy has a ₹3.5 crore ransomware coverage limit. However, paying ransoms requires prior insurer approval and may involve OFAC/sanctions checks if the threat actor is on a sanctions list. LockBit is under US Treasury OFAC sanctions. An Indian company paying a sanctioned entity may face regulatory consequences."

T+24 hoursDecision Point

72-hour ransom deadline: 48 hours remain. 3-month old tape restore would take approximately 5-7 days and lose recent patient records. Partial decryption of critical clinical systems (using threat actor's tool, if ransom paid) could restore within hours. CERT-In has acknowledged your report and assigned a case officer.

Inject — Board: "We need a board decision on the ransom by 3 PM today. The Medical Director says we will have to start diverting complex cases to other hospitals if HIS is not restored within 48 hours — that affects patient outcomes. Legal says paying may violate IT Act. Finance says we have the liquidity. What is the security team's recommendation?"

🏥 Clinical Operations Continuity Framework

Healthcare ransomware is uniquely dangerous because system downtime directly affects patient safety. Every cyber decision has a clinical consequence. The following framework helps structure the clinical-technology discussion.

Immediate Clinical Priority Matrix

System	Clinical Impact if Down	Workaround Available?	Priority for Restoration
ICU Monitoring / HIS	Medication errors, missed changes in patient condition, allergy information loss	Manual — paper charts, direct nursing observation	Critical — First
Blood Bank System	Transfusion matching delays, emergency blood unavailable	Manual ledger — slow, error-prone for emergency	Critical — First
PACS (Radiology)	Cannot read CT, X-ray, MRI — delayed diagnosis for trauma, stroke, cardiac	Film printing (if printer available) — limited	Critical — First
Lab Information System	Results cannot be transmitted electronically — verbal communication risk	Phone/WhatsApp reporting — acceptable short-term	High — Second
Pharmacy System	Medication dispensing errors, controlled substance tracking	Manual dispensing with double-check protocol	High — Second
OT Scheduling	Surgery cancellations, resource allocation errors	Manual whiteboard — acceptable short-term	Medium — Third
Billing / Admissions	Revenue impact — no patient safety risk	Paper forms — fully workable	Low — Last

Downtime procedures that should already exist (NABH requirement)

✓Paper-based medication administration records (MAR) — pre-printed, available in nursing stations

✓Manual blood bank crossmatch protocol — does not require LIS

✓Verbal/written lab result reporting with read-back verification

✓Downtime radiology protocol — direct film review where available

✓Emergency contact list for all departments — not stored only in HIS

✓Generator/UPS policy for medical equipment independent of IT systems

✓Patient diversion criteria — when to stop accepting emergency cases

⚖️ Ransom Decision Framework — Indian Law

Decision Factors

Patient safety risk

Direct risk to patient outcomes if systems not restored within 48 hours (ICU patients)

Backup restoration timeline

3-month old tapes — 5-7 day restoration. Critical clinical data from last 3 months lost.

Legal status of payment (India)

No specific Indian law prohibits paying cyber ransoms. However, payment may implicate IT Act Section 66 depending on interpretation.

OFAC sanctions risk

LockBit operators are under US Treasury OFAC sanctions. Indian companies transacting with sanctioned entities may face secondary sanctions risk if USD-denominated transactions used.

Insurer position

Cyber insurance covers ransomware (₹3.5 crore limit) but requires prior approval and may exclude sanctioned entities.

Payment guarantee

No guarantee decryption tool will work. LockBit has a published decryptor success rate — but threat actors occasionally take payment without delivering.

Data publication risk

Threat actor claims to have exfiltrated 2.4 lakh records. Payment of ransom does NOT guarantee data deletion.

CERT-In / government position

CERT-In does not endorse ransom payment but does not prohibit it. MoHFW may have a stronger view given government sensitivity.

Negotiation option

Threat actor has initiated contact. Ransom negotiation (without committing to pay) buys time and may reduce amount.

Decision matrix — before the board meeting

Should you engage a professional ransomware negotiator before deciding?

Yes — always engage. A professional negotiator extends the timeline (buying your technical team more time), can verify the threat actor's decryption capability, and may reduce the demand significantly. Engaging does not commit you to payment. Many healthcare ransomware incidents are resolved at 20-30% of initial demand after negotiation.

The Medical Director says patient safety requires system restoration within 24 hours. Does this change the ransom calculation?

Option 3 is correct. The clinical risk assessment (what patient harm is likely from extended downtime) must be conducted independently by medical leadership — not by the CISO. If medical leadership formally certifies that patient harm is likely within a defined timeframe, that changes the calculus. But cyber and clinical decisions must not be conflated — otherwise criminals can manufacture clinical urgency to force payment.

Your legal counsel says paying LockBit (under OFAC sanctions) could create legal risk for the organisation. What do you do?

Option 1 is correct. OFAC has extraterritorial reach — transactions processed through the US financial system (even for a rupee payment that converts through USD somewhere) can create exposure. Get a rapid opinion from a sanctions specialist. This should take 4-6 hours, not days. Option 2 understates the risk — Indian entities doing business with US financial institutions can face consequences for OFAC violations.

📋 Healthcare Ransomware — Regulatory Obligations

Regulator	Obligation	Timeline	Healthcare-Specific Notes
CERT-In	Mandatory ransomware incident report	6 hours from detection	Ransomware is explicitly listed in CERT-In Directions 2022 Section 3(i). Non-filing is a separate violation from the breach itself.
MoHFW	Report cyber incident affecting health data systems. ABDM participant obligation.	As soon as practicable — treat as 24 hours	Ayushman Bharat Digital Mission data is national health infrastructure — MoHFW takes direct interest.
NABH	Adverse event reporting if patient harm occurs or is risked	Within 24 hours of adverse event	Ransomware-induced system downtime causing patient harm must be reported as an adverse event under NABH standards.
Data Protection Board	Personal data breach — 2.4 lakh patient records	72 hours (when DPB operational)	Patient health data is the highest-sensitivity category under DPDP. Maximum penalty exposure applies.
Cyber Insurance	Notify insurer before any ransom payment decision	Immediately — 24 hours maximum	Most policies require prior insurer approval for ransom payment. Late notification may void coverage.
Cyber Cell / Police	FIR for extortion under IT Act Section 66 and IPC Section 384	Within 24 hours	Extortion (ransom demand) is a criminal offence. FIR preserves legal options including international cooperation for fund recovery.
State Health Directorate	Report if government health schemes data affected (Ayushman Bharat)	Within 24 hours	State government health scheme beneficiary data may be in the HIS. State health directorate must be informed.

📊 Debrief Guide

Core learning points for healthcare CISOs

→Healthcare ransomware is not a cyber problem — it is a patient safety problem. The clinical leadership must be in the room from minute one, not called in at hour three.

→Downtime procedures are a regulatory requirement (NABH) and a patient safety essential — if your hospital does not have documented, tested, paper-based downtime procedures, that is the first gap to close after this exercise.

→The ransom decision requires input from Medical Director (clinical risk), Legal (sanctions/IT Act), Finance (payment mechanism), Board, and CISO together — no single person owns it.

→Backup integrity is the most important security control for ransomware resilience. A 3-month old tape that fails to restore after 7 days is a patient safety risk, not just a business continuity issue.

→Threat actor contact (the CEO personal email) demonstrates prior intelligence gathering — this was not opportunistic. Healthcare is a targeted sector due to ransom payment rates.

→Paying LockBit (OFAC-sanctioned) creates US sanctions exposure for Indian healthcare entities — this is a real and underappreciated risk in the Indian CISO community.

AIIMS 2022 — What actually happened (reference)

The November 2022 AIIMS Delhi ransomware attack is India's most significant healthcare cyber incident. Approximately 40 million patient records were affected. AIIMS operated on manual processes for approximately 15 days. The HIS was restored using backups over a prolonged period. Ransom was not paid (confirmed by government). The attack was attributed (by Indian agencies) to a China-nexus group. CERT-In was involved. No criminal arrests have been publicly confirmed. The incident directly influenced CERT-In's enhanced healthcare sector focus in subsequent years.