Ransomware Attack on Hospital Network

A major government hospital network was hit by ransomware encrypting 50,000+ patient records. Students will reconstruct attack timelines, analyze lateral movement, and assess security vulnerabilities.

# Aplly.xyz Case Study Submission

## Title
Ransomware Attack on Hospital Network

## Type
Cybercrime & Digital Forensics

## Difficulty
Intermediate

## Estimated Time
60 minutes

## Overview
A major government hospital network was hit by ransomware encrypting 50,000+ patient records. Students will reconstruct attack timelines, analyze lateral movement, and assess security vulnerabilities.

## Case Details

Function Focus: Cybercrime & Digital Forensics — manual reasoning, decomposition, and critical judgment (no spreadsheet or AI tool permitted in Phase 1)

Scenario:
You are the analyst at a fictional consultancy ("Praxis Advisors") tasked with answering: Ransomware Attack on Hospital Network. You have a clean, synthetic dataset described below. You must produce a defensible answer using structured reasoning — no tool-assisted shortcut on the first pass.

Dataset Structure:
- event_id
- timestamp
- system_affected
- department
- ransomware_variant
- encrypted_files_count
- ransom_amount_usd
- paid
- downtime_hours
- patients_affected
- backup_available
- backup_restored
- data_exfiltrated
- entry_vector

Tasks:
1. Sort/segment the records to isolate suspicious entities (IPs, accounts, devices). Do this by hand first.
2. Map the connections between entities into a network; identify hubs, bridges, or high-risk clusters.
3. Correlate timestamp/event columns to reconstruct an attack or fraud timeline and locate the first-mover root source.
4. Score or rank candidate entities by risk using the dataset columns, justifying weights explicitly.
5. After your manual pass, re-run the risk ranking in a tool and reconcile any differences.

Expected Output:
A one-page incident analysis memo: suspect/entity shortlist with risk scores, network/timeline map, root-source identification.

Evaluation Criteria:
Soundness of the network/timeline reconstruction, correct risk-scoring methodology, evidence integrity reasoning.

## Data Sources

| event_id | timestamp | system_affected | department | ransomware_variant | encrypted_files_count | ransom_amount_usd | paid | downtime_hours | patients_affected | backup_available | backup_restored | data_exfiltrated | entry_vector |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| R001 | 2026-03-15 02:34 | Patient DB Server | IT | LockBit 3.0 | 85000 | 500000 | False | 72 | 2400 | True | True | True | Phishing email |
| R002 | 2026-03-15 02:35 | EMR System | Records | LockBit 3.0 | 220000 | 500000 | False | 96 | 3200 | True | True | True | Phishing email |
| R003 | 2026-03-15 02:36 | Radiology PACS | Radiology | LockBit 3.0 | 45000 | 500000 | False | 48 | 1800 | True | False | True | Phishing email |
| R004 | 2026-03-15 02:38 | Lab System | Pathology | LockBit 3.0 | 32000 | 500000 | False | 36 | 1200 | True | True | True | Phishing email |
| R005 | 2026-03-15 02:40 | Billing System | Finance | LockBit 3.0 | 28000 | 500000 | False | 60 | 0 | False | False | True | Phishing email |
| R006 | 2026-03-15 03:00 | AD Server | IT | LockBit 3.0 | 5000 | 500000 | False | 96 | 0 | False | True | False | Phishing email |
| R007 | 2026-03-15 03:15 | Nurse Station Terminals | Nursing | LockBit 3.0 | 12000 | 500000 | False | 48 | 4000 | False | False | False | Lateral spread |
| R008 | 2026-03-15 03:30 | Ambulance Dispatch | Emergency | LockBit 3.0 | 800 | 500000 | False | 24 | 500 | True | True | False | Lateral spread |
| R009 | 2026-03-15 04:00 | Pharmacy System | Pharmacy | LockBit 3.0 | 15000 | 500000 | False | 52 | 3000 | True | True | True | Lateral spread |
| R010 | 2026-03-15 05:00 | Scheduling System | OPD | LockBit 3.0 | 18000 | 500000 | False | 40 | 5000 | True | True | False | Lateral spread |


Full dataset: https://github.com/arora200/aplly_case_db/datasets/063-cybercrime-ransomware-hospital (synthetic, 15 records)

## Solution Frameworks
Network/graph analysis, log correlation, kill-chain mapping, anomaly detection, chain of custody & evidence integrity

## Solver Guidance & Tutorials
_Solver guidance added by the pipeline (tutorial links) — see `solver_guidance` field._

## What You'll Learn
- Map relationships into actionable networks
- Reconstruct attack timelines from logs
- Score risk from raw attributes

## Tags
Ransomware, Cybercrime, Network Forensics, Healthcare Security

## Registration Links
Register as Solver / Register as Evaluator