Summary

An extortion email reaches a small health-tech company with two hundred real patient records and a countdown. Nothing in the company’s systems is down, locked or even alarmed. The scenario is written for a practice-management software company of about forty people, with the CEO, the one security-minded engineer, customer success and a board member in the room. It exercises a decision no ransomware plan prepares a team for: whether to answer the thief, who may do it, and what the samples prove about the rest.

Ground rules

• This is a no-fault discussion. Disagreement is expected, and nobody is being graded as a person.
• There are no trick questions. Some reports in this story will turn out to be wrong, as they do in real incidents, but the narrator never misleads you.
• The facts are as the facilitator reads them. Work with what arrives.
• Answer with the people, tools and plans you have today.
• Have your own incident response plan open. Some questions ask what yours says.
• Decisions are not precedent setting and may not reflect your organization's final position on a given issue. This exercise is an opportunity to discuss and present multiple options.

Setting

Quillmont Health sells scheduling, charting and billing software to physical-therapy and dental clinics, about three hundred of them. Forty people. The main application runs on a public cloud behind a web application firewall, and every employee signs in through one identity provider. Beside it, on a single older server in the same cloud network, sits the staff and payroll module the company built in its first year. It has been “being retired” for eighteen months. To produce its reports it reads from a nightly copy of the main database.

The CEO is Esther Delgado. The only person who thinks about security full time is Tobias Oyelaran, a senior engineer. Ade Bakare, the co-founder and CTO, is the last person who understands the payroll module, and he is on leave this week, hiking, mostly out of signal. Nina Park runs customer success. Harriet Vance chairs the board. The incident plan was written two years ago after a ransomware scare at a peer company. Its first step is to isolate infected systems, and the three pages after that are about restoring from backup.

Roles at the table: Esther, Tobias, Nina, Harriet and the head of operations.

The first sign

Thursday, 07:10. An email lands in the company’s general contact inbox, in Esther’s inbox, and in the personal inboxes of two board members, Harriet among them. The subject line is the company’s name. The body is polite and short: the sender has Quillmont’s data, attaches a spreadsheet of two hundred patient records “as proof,” and gives the company three days before the full set is published. It names no price and gives a chat address for “discussion.”

Esther sees it at 07:40 on her phone, assumes it is a scam, and forwards it to Tobias with one line: “Is this real?”

Tobias opens the spreadsheet. The names, dates of birth and visit notes look real. He recognizes two clinic names.

What happens next

T+10 minutes. Harriet calls Esther. She has already replied to the email from her personal account, at 07:15, asking who the sender is and what they want. There is no answer yet. Harriet says she did it to buy time.

Ask the room: Who is allowed to speak to the sender on the company’s behalf? Does your own incident response plan say? What has Harriet’s reply told the sender, if anything? Does anyone ask her not to reply again, and who has the standing to ask the chair of the board?

T+25 minutes. Tobias checks the alerting history for the last ninety days. Nothing stands out. The web application firewall shows a run of blocked requests against the main application seven weeks ago and nothing unusual since. Backups ran every night. No system is slow, locked or missing files. Tobias reports that by every measure the ransomware plan uses, nothing has happened.

Ask the room: The plan’s first step is to isolate infected systems. Which systems are infected? Who is running this incident, and is it being run as an incident at all yet?

T+45 minutes. Nina compares the spreadsheet against recent exports. She reports that the two hundred rows match, column for column, a patient list her team pulled for a dental group last month to help them move clinics. The customer success manager who made it, Jonah, kept a copy on his laptop. Jonah says his laptop was in his car when the car was broken into two weeks ago; he reported the car, not the laptop. Nina puts it down to a stolen laptop holding one customer’s records and starts drafting a note to the dental group.

Ask the room: What evidence is the stolen laptop theory built on, and what would disprove it? Should Nina’s note go out before anyone checks? Who approves a message to a clinic about its patients’ records?

T+80 minutes. Tobias compares the export file with the spreadsheet. The column order matches; the contents do not. Eleven rows carry appointment notes that differ from the export. One row is a patient whose record was created nine days after Jonah’s export was made. Tobias says the export cannot be the source. The note to the dental group is still in Nina’s drafts.

Ask the room: What was the stolen laptop theory based on, and what would have tested it before the note was drafted? Is the stolen laptop now irrelevant, or is it a second problem the team still has to handle? What does the team now believe the sender has, and on what evidence?

T+100 minutes. A second email arrives, to the same addresses plus the general press inbox. It links to a leak site that lists Quillmont Health by name, with a timer. It mentions Harriet’s reply and says the sender is “glad the board is engaged.” Twenty minutes later a health-industry reporter emails Esther asking for comment on “a listing of your company on an extortion site.”

Ask the room: Does the team engage with the sender at all, and who decides? What does Esther say to the reporter, if anything, and who reviews it? Who outside the company should hear about this before the reporter’s story runs, if one does?

T+2 hours. Tobias widens the search to the old payroll module’s server, which nobody had thought to check because it does not hold patient data. In a folder meant for staff to upload expense receipts he finds a small file with a script extension, last changed five weeks ago. The server’s web log shows requests to that file from addresses outside the company on dozens of days since.

Ask the room: Is the payroll module the way in, and what would make the team sure? What else could that server reach? Does anyone change anything on it before deciding what to keep as evidence?

T+2 hours 20 minutes. Tobias wants to take the payroll server offline now. The operations head points out that payroll runs tomorrow morning from that module, for Quillmont’s own staff, and Ade is the only one who knows how to run it any other way. Ade’s phone goes to voicemail. His last message, from yesterday, is a photo of a ridge.

Ask the room: Who can make the call to take down a system its owner is not here to defend? What does the company lose by pulling it now, and what does it risk by waiting until Ade calls back? What gets saved from the server before it goes dark?

T+2 hours 45 minutes. Tobias traces the payroll module’s database connection. Its account can read the full nightly copy of the main database: every patient at every clinic, about four hundred thousand people. The web log shows the most recent request to the hidden file at 02:14 this morning, five hours before the first email was sent. Nobody can say whether the sender has two hundred records, one clinic’s worth, or all of them, and nobody can yet say the sender has left.

Ask the room: What does the team call this now, and to whom? What does “contained” mean when the thief may still have a key? Which of the three hundred clinics hear from Quillmont first, and what are they told when the honest answer is “we do not know how much”?

Standing questions

• Who is authorized to communicate with the sender, the press and the board, and does everyone at the table, including the board, know it?
• What is the team calling this (an extortion attempt, an intrusion, a breach, or unknown), and what evidence would change that name?
• What evidence on the payroll server disappears the moment someone takes it offline or deletes the file?

Generic rubric

Did the team:

• Name an incident lead early, and did everyone at the table agree who that was?
• Name someone to keep a timed record of every decision and action as it happened?
• Assign someone to communications who was not also working on the incident itself?
• Decide, against criteria they could state, whether this was an incident and how severe it was?
• Decide when leadership would hear about it?
• Establish who could authorize high-impact actions, such as taking a system offline?
• Decide who acts when that person cannot be reached?
• Determine whether this is a security incident, a data breach, a contractual matter, or some combination, and on what evidence?
• Check how far it reached beyond the first system they found?
• Keep a current list of what is known, what is suspected and what is unknown?
• Weigh containment against investigation before acting?
• Preserve the logs and other evidence before taking any action that would alter them?
• Check what their customer agreements say about incidents and notification before drafting anything for a customer?
• Check what their vendor agreements say about incidents, in both directions?
• Call legal, or decide explicitly not to, at the point they first suspected unauthorized access?
• Make an explicit decision about contacting law enforcement?
• Check their cyber insurance policy's notice and consent terms before engaging outside responders or discussing payment?
• Agree one approved message for staff, customers and leadership?
• Send it over a channel they had reason to trust?
• Decide explicitly whether to engage with the sender and who would do it, and stop anyone else from replying?
• Test the stolen laptop theory against the data before acting on it, and hold the customer note until they had?

Postmortem prompts

• The incident plan began with isolating infected systems and restoring from backup. What would a plan look like whose first page assumed nothing was broken?
• The payroll module was “being retired” for eighteen months and still held a key to every patient record. Who owned the risk of that key, and did they know it?
• A board member replied to the sender before the company met. What did the board know about its role in an incident, and who was supposed to tell them?
• The stolen laptop theory was attractive because it was small. What check would have caught it before a note to a clinic was drafted?
• The hidden file sat in the receipts folder for five weeks. What would have had to be watched, and by whom, for the first sign to be something other than the thief’s own email?