Ransomware · Incident Response
Why Backups Alone Are Not Enough to Protect Hospitals from Ransomware
Many hospitals rely on backups to recover from ransomware, but restoring systems often takes days or weeks. Experts warn that backups alone can't guarantee a quick recovery.
Ross Grant3 min read
The short version
Hospitals often think backups will let them recover quickly from ransomware attacks. In reality, restoring systems from backups can take days or weeks. This means patient care and hospital operations may be disrupted for much longer than expected. Experts say hospitals need more than just backups to stay safe.
What happened?
A report from BankInfoSecurity highlights that hospitals relying on backups to recover from ransomware attacks often face long delays. Restoring systems can take days or weeks, not hours. Experts say incident response plans often fail under real-world pressure.
Backups: Not the Silver Bullet Hospitals Hope For
Hospitals are frequent targets for ransomware attacks. Many believe that having backups means they can quickly bounce back if their systems are locked down. But according to a report from BankInfoSecurity (opens in a new tab), the reality is more complicated. Most hospitals do not recover within a day after an attack, even if they have backups in place.
Omar Hussain, CEO and co-founder of a security firm, told BankInfoSecurity that restoring data from backups is a slow process. It can take days or even weeks to get critical systems running again. This delay can put patient care at risk and disrupt hospital operations far longer than many expect.
Why Recovery Takes So Long
Backups are only one part of the recovery process. When ransomware strikes, attackers often encrypt large amounts of data and disrupt many systems at once. Hospitals then face the challenge of restoring not just files, but entire systems, applications and configurations. Each step must be checked to avoid re-infection or further damage.
Even with modern endpoint detection and response (EDR) tools, some attacks still get through. Once systems are compromised, restoring from backups is rarely as simple as clicking a button. The process is slowed by the need to verify data integrity, prioritise which systems to restore first, and coordinate across departments.
Incident Response Plans: Theory vs. Reality
Many hospitals have incident response plans that look solid on paper. These plans are often tested in tabletop exercises, where staff talk through what they would do in an attack. But Hussain points out that these exercises cannot fully prepare teams for the chaos of a real incident. When an actual attack hits, the stress and complexity can overwhelm even well-prepared teams.
In the words of Hussain, "In theory, when you're sitting around a table and having coffee and figuring it out, it's nice. But when floors four, five, six, seven and eight are burning, everything goes out the..." The point is clear: real-world attacks are messier and more stressful than any drill.
What Hospitals Can Do
While backups are essential, hospitals need a broader approach to ransomware defence. This includes:
- Regularly testing backups to ensure they work and can be restored quickly
- Practising full-scale incident response drills, not just tabletop exercises
- Investing in layered security controls, such as network segmentation and strong endpoint protection
- Keeping software and systems up to date to reduce vulnerabilities
Hospitals should also plan for extended downtime and have procedures in place to continue critical care even if systems are offline.
The Bigger Picture
Ransomware is a growing threat to healthcare. While backups are a key part of resilience, they are not a guarantee of quick recovery. Hospitals and other critical organisations need to plan for the worst and build robust, realistic defences that go beyond simply having backup copies of data.
Claimed vs confirmed
- Unconfirmed
Backups allow hospitals to recover quickly from ransomware.
BankInfoSecurity reports that most hospitals do not recover within a day, but no hospital or agency has confirmed this.
The impact
- Money
- Hospitals may face high costs from downtime, recovery efforts and possible fines. Under UK GDPR, fines can reach £17.5m or 4% of annual turnover, though no fines are reported here.
- Reputation
- Slow recovery from ransomware can damage trust in a hospital's ability to protect patient data and deliver care.
- Customers
- Patients may experience delays or disruptions in care if hospital systems are down for days or weeks after an attack.
Why it matters
Ransomware can shut down hospitals, putting patient care at risk. Many rely on backups to recover, but this process is slow and complex. Understanding the limits of backups helps hospitals and other organisations prepare better for attacks.
How does it work?
Ransomware is a type of malware that encrypts files and systems, making them unusable until a ransom is paid. Even with backups, restoring large hospital networks is complex and time-consuming, often requiring careful checks to avoid re-infection.
Key points
- Backups are essential but not enough for quick recovery from ransomware.
- Restoring hospital systems from backups can take days or weeks.
- Incident response plans often fail under real-world attack conditions.
- Regular testing and realistic drills improve preparedness.
- Layered security and up-to-date systems help prevent attacks.
Sources
BankInfoSecurity
Reference
- Why Backups Alone Can't Save Hospitals From Ransomware (opens in a new tab)
bankinfosecurity.com
- Why Backups Alone Can't Save Hospitals From Ransomware (opens in a new tab)
