DFIR and Clinic Recovery After LockBit

Three Reasons the Clinic Was One Step Away From Collapse 

The attack was preceded by warning signs the clinic had seen before: phishing emails had arrived before, but they had always been blocked. Suspicious RDP activity, however, was overlooked once. The attackers exploited this window and then quietly prepared for the attack.

Formally, the problem sounded simple: “The servers were encrypted.” In reality, this meant that within 72 hours, a clinic treating patients every day could be brought to a halt indefinitely, while its patient database could be leaked on the dark web. Three factors made the situation particularly difficult:

1. The backup was also encrypted. The go-to “we’ll just restore from backup” scenario did not work – the backup server was just as much a target of the attack as the production infrastructure.
2. 45 days of undetected preparation. The attackers managed to exfiltrate 12 GB of data and study the network from the inside – long before anything was encrypted.
3. Two deadlines at once. 72 hours before the attackers threatened to publish patient data on the dark web – and the same 72 hours to submit a notification under the GDPR. Time was working against the clinic on two fronts.

The bottom line: 4 EMS servers, 2 file servers with 120 TB of data, a backup server, and 45 workstations – all offline. The attackers demanded a $2.1 million ransom, while total potential losses, including the ransom, fines, and lost revenue, were estimated at $7–9 million.

And that was not all. Operations came to a halt for 85 employees, while the ability to receive patients – the clinic serves more than 25,000 a year – was at risk. There were also legal concerns: since the data processing was subject to the GDPR, the incident created a risk of penalties under the regulation and Ukraine’s Law on Personal Data Protection.

In addition, there were risks related to the protection of medical confidentiality and a potential impact on compliance with ISO/IEC 27001 requirements, which is important for working with international partners.

The Datami team faced three tasks:

The First 45 Minutes: Decision Made, Team On-Site 

The decision was made immediately: no ransom payment and no waiting for a single recovery source to save the situation. The investigation, data recovery, and vulnerability remediation were carried out in parallel rather than sequentially – there was simply no time for “first one thing, then another.” The white-box access provided – full admin rights, physical access to the data center, and backup keys – eliminated approval delays.

The team was on-site within 45 minutes of the call. The work was organized into five partially parallel phases, from threat isolation to long-term protection, and the speed at each stage was measured not in general terms, but in specific hours:

1. Open RDP closed – 1 hour.
2. Passwords changed for all accounts – 24 hours.
3. EDR deployed – 48 hours.
4. MFA implemented for everyone – 72 hours.
5. Network segmentation completed – 7 days.

The CIO received an update every 4 hours, while management received a daily briefing.

Once the core systems were operational, we tested the restored infrastructure for vulnerabilities through penetration testing. What exactly it revealed is covered in the section below.

Incident Recovery, Penetration Testing, and Compliance Audit

As part of the project, the Datami team provided three services: incident recovery, penetration testing of the secured infrastructure, and a GDPR compliance audit – sequentially, as each preceding stage was completed.

The team tested several recovery options in parallel, each with its own limitations. The backup server had been encrypted along with the rest of the infrastructure, so the standard “restore from backup” scenario was immediately ruled out.

Local Shadow Copies made it possible to recover some files, but there were not enough available copies to restore the entire dataset. The analysis was further complicated by intermittent encryption – selective encryption of parts of files, which LockBit 3.0 used to speed up encryption.

The isolated storage device (offline NAS), which was not connected to the network at the time of the attack, became the primary recovery source. Most of the data was restored from it using Veeam and SQL Recovery for structured EMS records.

There was also a purely physical problem. Given the available bandwidth, transferring 120 TB over the network within the required timeframe was impossible, so some of the storage drives were physically transported.

The Trace Left by the Attacker

One detail stood out: among 80,000 medical records, three remained unencrypted. The team assumed that the attackers may have used them to verify access before the main attack. The timeline of the 45-day intrusion was reconstructed primarily from logs and other digital artifacts.

At the same time, communication between the infrastructure and the attackers’ C2 server was blocked. The team helped the client notify the competent authorities about the compromise and the exfiltration of 12 GB of data in accordance with applicable requirements.

Custom Solutions

There was no ready-made, out-of-the-box solution for every step, so the team developed some of the tools themselves:

• A script using Volatility to analyze memory dumps, tailored to the specific LockBit 3.0 build;
• Automated correlation of indicators of compromise with Active Directory and Exchange logs – to trace all 45 days of the attacker’s presence;
• Accelerated recovery of SQL Server records from damaged .mdf/.ldf files.

“Before / After” Architecture

Before: flat network without segmentation, an unsecured RDP port exposed to the internet without MFA, no EDR, passwords on 12 accounts had not been changed for years.

After: segmented network, access only via VPN, EDR on every endpoint, MFA everywhere, password rotation, and a 3-2-1 backup scheme with an offline copy.

Validation Penetration Test and Compliance Audit

Mitigating the consequences of an incident is one thing; verifying that the remediation was effective is another. After the recovery, the team conducted a penetration test of the secured infrastructure – they simulated an attack and checked the system for security weaknesses, identifying weak passwords susceptible to brute-force attacks in 12 accounts.

The test confirmed that external RDP access had been closed, MFA and segmentation had been configured correctly, and the previous attack path could no longer be reproduced.

After the issues identified during the penetration test were resolved, a GDPR compliance audit was conducted as the final check following the recovery and strengthening of the infrastructure’s security.

Only then did the team tell the client: now it is truly secure.

Technology Stack

• Forensics and analysis: Volatility, Wireshark, YARA, Velociraptor, Ghidra, IDA Pro
• Data recovery: PhotoRec, Veeam, SQL Recovery, Shadow Copy
• Security and hardening: Microsoft Defender EDR, Azure MFA, FortiGate
• Standards and baselines: NIST SP 800-61, MITRE ATT&CK, Microsoft and CIS Security Baselines
• Project coordination: Slack, Zoom, Teams, Signal (encrypted), Jira, Confluence, SecureDrop

From Chaos to Control: Five Phases Over 45 Days of the Project

The team organized the work into five phases:

1. Threat isolation and containment – 0–4 hours.
2. Investigation – 4–24 hours.
3. Recovery – 24–72 hours.
4. Remediation – up to 14 days.
5. Security hardening – up to 30 days.

During the first two phases, the team disconnected the infected systems, isolated the network, preserved forensic evidence, closed external RDP access, and identified the attack vector. In parallel, they analyzed memory dumps and logs, reverse-engineered the ransomware, and confirmed the extent of the compromise.

Data was recovered from the offline NAS using Veeam and SQL Recovery, restoring 99.2% of the images. Account passwords were changed at several stages: first, immediately after the issue was identified during the investigation, and then again when the penetration test revealed another 12 accounts with weak passwords. In total, 8 vulnerabilities were fixed and 3 backdoors were removed during the project.

As a result, the security infrastructure was rebuilt almost from scratch: the ransom was not paid, Active Directory was rebuilt, the network was segmented, EDR was deployed, MFA was implemented across the entire environment, and remote access was allowed only through VPN. In parallel, IR and DR plans were developed, the principle of least privilege was implemented, quarterly cybersecurity awareness training was scheduled for the client’s IT team, and documentation was prepared for GDPR and ISO/IEC 27001 compliance. The security hardening phase, planned for 30 days, was completed in 28.

Project Results: Cybersecurity and Financial Impact

At the end of the project, the client received a final 85-page report and a practical security workshop for the client’s IT team, ensuring that the knowledge stayed within the organization instead of remaining only in the report.

What changed at the infrastructure level:

• Data: 100% of medical records and 99.2% of images recovered.
• RDP: external access closed, with connections allowed only via VPN.
• MFA: implemented with 100% coverage.
• EDR: deployed on every endpoint, providing automated detection and activity monitoring.
• Network segmentation: the network was divided into isolated segments, with critical EMS systems separated from the rest of the infrastructure.
• Vulnerabilities: 8 fixed, 3 backdoors removed.
• Architecture: rebuilt as an HA infrastructure with multi-layered protection and 24/7 monitoring.

What this means for the business:

• $2.1 million ransom demand: rejected, $0 paid.
• GDPR notification to the supervisory authority: submitted within 66 hours, within the required timeframe (meeting this requirement does not guarantee that no penalties will be imposed).
• Financial risk: $7–9 million in potential costs were avoided (ransom demand, losses from downtime, risk of a GDPR fine, potential patient attrition).
• Insurance terms: according to the client’s assessment, improved by approximately 30%.
• Cyber resilience on Datami’s internal scale (0–10 points): increased to 8 (after implementing EDR, MFA, segmentation, and remote access).
• Full recovery: completed in 13 days instead of the planned 14.

What was recommended for the future:

• In the near term: quarterly DR exercises, annual penetration testing, and retesting immediately after the security hardening phase.
• Long term: migration to a cloud-based EMS, implementation of SIEM (Sentinel) and SOAR, and a move toward Zero Trust.

Rapid Response and Expertise: Results Without Paying the Ransom

Healthcare organizations are an attractive target for attackers due to the value of their data and their critical dependence on the uninterrupted operation of digital systems.

Thanks to the experience and rapid response of the Datami team, the clinic did not have to pay the $2.1 million ransom. A total of 80,000 medical records and 99.2% of images were recovered, while reputational consequences were minimized.

This case demonstrates a simple point: even after a large-scale attack on critical infrastructure, recovery without paying a ransom is possible if a team with experience responding to exactly these types of incidents is brought in quickly.

Already Hit by a Cyberattack? Don’t Delay!

Every hour of delay increases recovery costs and the risk of permanent data loss.

If your company is facing a cyberattack right now, contact Datami immediately – we’ll help you recover from a cyber incident.