T+0:00Degraded Access31 service desk calls, nobody has said ransomware yetM1
T+0:22Ransom NoteThree failed backup jobs and a fifty-hour-old restore pointM1
T+0:50The Shutdown DecisionContainment costs you badge access and nurse call escalationM2
T+1:05Downtime RealityForty printed packets for a hospital running 148 patientsM2
T+1:18Shift ChangeDay shift arrives untrained into a building that does not workM2
T+1:45The ReporterThe press has it before your own staff doM3
T+2:00Diversion and EMSStaying open harms someone, diverting harms someone elseM3
T+2:15ExposurePatient names on a leak site and a clock nobody was trackingM3
T+2:35The Ransom QuestionThe board is on the phone and asking what you recommendM4
T+2:50Recovery SequencingEvery department wants to be first and root cause is unknownM4
The downtime packet inventory did not match the continuity plan. Authority to grant a clinical
policy variance mid-incident was not clearly held by anyone in the room. The sixty-day
notification clock started before Command knew the data was exposed.
Findings from the Code Dark hotwash. Planted on purpose.
A tabletop everyone passes
taught you nothing. These are built so the gaps most hospitals already have surface on their
own, which is what turns them into findings instead of somebody's opinion.