When an attack hit 40 workstations across three medical campuses, clinical systems were restored rapidly with zero ransom paid.
The Incident
Adversaries infiltrated the hospital network via compromised contractor VPN credentials and initiated overnight file encryption. The attackers attempted to spread laterally across the network.
The Defense Reaction
- Endpoint behavioral protection halted the encryption process across most endpoints.
- DLP detected anomalous bulk file encryption attempts and terminated the process.
- All 40 affected workstations were isolated from the network with one click.
- The electronic health record system returned to 100% capacity in 18 minutes.
The Takeaway
Contractor access was tightened with continuous SSPM and endpoint health gates, blocking non-compliant devices from corporate networks.
Author Experience & Editorial Standards
M
Moftgate Customer SuccessSecurity Research
Moftgate Threat Labs security researchers and engineers specializing in Data Loss Prevention (DLP), unified endpoint management, and sovereign on-premises architectures.
✓Technically reviewed by: Moftgate Threat Labs