Ransomware, data breaches and attacks on organizations

At 7:20 on the morning of Saturday, July 11, 2026, the office manager of the Lakeshore Family Health Team, a clinic with eleven doctors and about 14,000 patients in Port Ardent, turned on the reception computer and found that every file had a new ending and could not be opened. A text file on the desktop said that the clinic's network had been encrypted, that 80 gigabytes of patient records had been copied, and that unless the clinic paid the equivalent of 350,000 dollars in cryptocurrency within five days, the records would be published on a leak site. It gave a web address for 'customer support'. She called the clinic's lead physician, who called the clinic's information technology contractor, who called the police non-emergency line at 8:05.

Constable Femi Okeke, who students will remember from the evidence course, took the call. He had never handled a ransomware report. Park tells the class that this is common, and that the most useful thing Okeke did was something simple: he asked the contractor not to wipe or rebuild anything until the cybercrime unit had been consulted, and he called the unit's on-call investigator. This lesson covers attacks on organizations, the police role in them, and what officers should and should not say.

What ransomware is

Ransomware is malicious software that encrypts a victim's files or systems so they cannot be used, followed by a demand for payment, usually in cryptocurrency, in exchange for a decryption key. Modern ransomware groups usually also copy the victim's data before encrypting it, and threaten to publish or sell it if the ransom is not paid. This is called double extortion. Some groups add further pressure by contacting the victim's customers or patients, or by flooding the victim's website with traffic. Ransomware attacks have hit hospitals, school boards, municipalities, police services, manufacturers and small businesses. For a health clinic, the harm is immediate: appointments cannot be booked, records cannot be read and prescriptions cannot be checked.

Many ransomware attacks are carried out under a business model called ransomware as a service. Developers build and maintain the malicious software and the payment and leak sites, and rent them to affiliates who carry out the attacks and share the proceeds. Other criminals specialize in gaining initial access to networks, by stealing passwords, exploiting unpatched software or sending phishing emails, and sell that access to affiliates. This division of labor means the person who sent the phishing email, the person who deployed the encryption and the person who runs the leak site may be different people in different countries. Desjardins says this is organized crime in the full sense, with suppliers, contractors, help desks and profit sharing.

How attacks unfold

A ransomware incident usually begins well before the ransom note. The attackers first get in, often with a stolen or guessed password for a remote access service that lacked a second factor of authentication, or through an employee who opened a malicious attachment. They then look around, gain higher levels of access, find and disable backups, and copy out valuable data. Only at the end do they encrypt. Investigators therefore need logs from the days and weeks before the encryption: login records, remote access records, firewall and network logs, and the systems' own event records. Many of these are kept only for a limited time and some are overwritten automatically. Rebuilding a network from scratch to get the business running again destroys them.

In the clinic's case, the cybercrime unit's investigator, working with the clinic's insurer's incident response firm, found that the attackers had logged in through the clinic's remote access portal nineteen days earlier, using the password of a part-time employee that had appeared in a list of stolen credentials from an unrelated website breach. The account did not require a second factor. Over the next two weeks the attackers created a new administrator account, disabled the backup software and copied the patient database to a cloud storage service.

# Measuring how long the attackers were inside before the ransom note
from datetime import datetime
events = [
    ("2026-06-22 02:14", "first login with stolen password via remote access portal"),
    ("2026-06-24 23:40", "new administrator account created"),
    ("2026-07-03 01:05", "backup software disabled"),
    ("2026-07-08 00:30", "large upload to cloud storage begins"),
    ("2026-07-11 03:10", "encryption begins; ransom note dropped"),
]
times = [(datetime.fromisoformat(t), what) for t, what in events]
start = times[0][0]
for t, what in times:
    days = (t - start).total_seconds() / 86400
    print(f"day {days:5.1f}: {what}")
dwell = (times[-1][0] - start).days
print("dwell time before encryption:", dwell, "days")

day   0.0: first login with stolen password via remote access portal
day   2.9: new administrator account created
day  11.0: backup software disabled
day  15.9: large upload to cloud storage begins
day  19.0: encryption begins; ransom note dropped
dwell time before encryption: 19 days

The dwell time, the period between the attackers' entry and the encryption, was 19 days. Every event in that period left records, and the most important ones were in the remote access portal's logs, which were set to keep thirty days. Had the contractor rebuilt the portal on the Saturday morning, as he had planned, the first login would have been lost.

The police role

Organizations hit by ransomware often hesitate to call police. They fear publicity, think police cannot help, or worry that an investigation will slow their recovery. Police and government cyber security agencies encourage reporting because it brings help and intelligence. Reports let investigators connect attacks by the same group, identify the infrastructure they use, and sometimes obtain decryption keys from seized servers. In several international operations, police have taken over ransomware groups' servers and given keys to victims for free.

The first officer's role is limited but important. Take the report and record what is known: when the problem was discovered, what the ransom note says, the contact address or website given, the amount demanded, and whether any communication with the attackers has taken place. Ask the organization to preserve evidence: not to wipe or rebuild affected systems until advised, to keep a copy of the ransom note, to isolate infected machines from the network by disconnecting them rather than turning them off where possible, and to keep logs. Connect the organization quickly with the specialist unit and CISA or the FBI's local field office. Many organizations will also bring in an insurer's incident response firm, and police should work with it rather than against it, agreeing who preserves what.

Desjardins stresses what the officer should not do. Officers should not try to examine infected computers themselves, which can destroy evidence or spread the infection. They should not give advice on whether to pay the ransom beyond stating their agency's position. Government and police agencies discourage payment, because it funds criminal groups and does not guarantee that data will be deleted or keys will work. The decision, however, is the organization's to make. Officers should know that the federal Treasury Department has warned that paying ransoms to sanctioned people or groups may itself violate sanctions law, which is a matter for the organization's lawyers, and should not promise outcomes.

Data breaches and notification duties

A data breach is the loss of, unauthorized access to, or disclosure of personal information. Ransomware with data theft is one kind; others include stolen laptops, misdirected emails, employees snooping in records and databases left open on the internet. Organizations that suffer a breach may have legal duties to notify the people affected and regulators, and these duties run alongside any police investigation. Under the federal health privacy rules, health care providers must notify affected patients of breaches of unsecured health information and report them to the federal Department of Health and Human Services, and breaches affecting 500 or more people must be reported promptly and publicly. Ohio's data breach law, Revised Code section 1349.19, requires businesses to notify Ohio residents whose personal information was compromised, generally within 45 days. Police should not interfere with these duties, but organizations sometimes ask whether they may delay notifying people so as not to tip off the attackers. Those requests should go through the specialist unit and the prosecutor, not the patrol officer.

Other attacks on organizations

Business email compromise, covered in lesson 3, is one of the costliest attacks on organizations, though it involves no malicious software at all. Denial of service attacks flood a website or service with traffic until it cannot respond; they are often used for extortion or protest. Insider offenses, by employees or former employees who abuse their access, account for a meaningful share of breaches and are often easier to investigate because the suspect is known. Attacks on industrial and building systems, such as water treatment plants or hospital equipment, are rarer but can endanger life, and are handled by national agencies with police support.

Park adds that small organizations are not too small to be targeted. Attackers often scan the internet for any system with a known weakness and attack whatever they find. A dental office, a church, a hardware store or a minor hockey association can be hit by the same group that hits a hospital. Prevention advice that police can give is simple and well established: use a second factor for remote access and email, keep software updated, keep offline or protected backups and test restoring them, train staff to recognize phishing, and have a plan with phone numbers written down on paper.

The clinic's outcome

The clinic did not pay. Its backups had been disabled, but a copy of the patient database from eight days before the attack was found on an old server the attackers had missed, and the clinic rebuilt its systems over twelve days, booking appointments on paper in the meantime. Five days after the deadline, a sample of the stolen data appeared on the group's leak site. The clinic notified its patients and the regulators, offered credit monitoring, and set up a phone line. The cybercrime unit shared the attackers' cloud storage account, wallet address and login details with the FBI, which linked the attack to a group responsible for dozens of others. No one has been arrested. Desjardins tells the class that this is a typical outcome, and that the report still mattered: it added to the picture of the group, and the stolen data in the cloud account was preserved under a legal order before the attackers could delete it, which may matter in a future prosecution.