Ransomware in Alberta Clinics: What the Last Twelve Months Taught Us
Patterns from healthcare incident response work across Southern Alberta — how intrusions start, how long they dwell, and the three controls that consistently cut them short.
Healthcare practices are attractive targets for an unglamorous reason: they hold sensitive records, they cannot tolerate downtime, and they usually run lean IT. The intrusions we respond to rarely involve novel tooling.
How they start
Remote access with a reused password, a mail thread hijack, or an unpatched edge device. In that order. None of these require sophistication — they require the absence of one control.
How long they dwell
Longer than practices expect. By the time encryption runs, the operator has usually been present for days, has found the backups, and has tested whether anyone notices administrative logins at unusual hours.
Three controls that consistently shorten the incident
- Enforced MFA on every remote path, including the one nobody remembers provisioning.
- Immutable, tested backups. Untested backups are a plan, not a control.
- Alerting on privileged logins outside business hours, routed somewhere a human reads.
None of this is expensive. All of it needs to exist before the day it matters.