UCSF’s ransom decision was shaped long before the attack

The week

On June 1, 2020, the University of California, San Francisco detected a security incident in a limited part of the IT environment of its School of Medicine. The attack was attributed to the NetWalker ransomware group, which encrypted servers and threatened to publish data. UCSF said the incident did not affect patient care delivery, its overall campus network or its COVID-19 research. Later in June, the university said it had paid approximately $1.14 million in exchange for a tool to unlock the encrypted data and the return of data the attackers had obtained. It explained that the encrypted data was important to academic work it pursued in the public interest. Press reports later described the negotiation with the attackers in some detail.

A ransom decision looks like a single choice made in a crisis. Most of its inputs, though, were fixed months or years before, by what the organization bought, contracted for and tested. Four inputs matter most. The first is how quickly the organization can recover without the attacker’s key. The second is how much harmful data the attacker could publish. The third is who pays for the response, and on what terms. The fourth is whether the legal and reporting process is ready. Each was visible in the UCSF case. The encrypted servers held academic work that was hard to recreate, the attackers threatened publication, the amount was negotiated, and the payment had to be lawful. Health systems and academic medical centers face the same four.

Recoverability: the cost of restoring without the key

The most important factor is whether the organization can restore without the attacker’s decryptor, and how long that would take. That depends on backups attackers cannot reach or delete, recovery procedures tested at realistic scale, and a clear view of which systems matter most. Departmental and research servers are often outside central backup programs. A department sets them up for its own needs, funds them from its own budget and runs them with its own staff.

Recoverability is bought in advance. Immutable or offline backups, periodic full-restore tests and an inventory that includes departmental systems are the core purchases. The right comparison is not backup spending against a ransom amount. It is backup spending against weeks of lost research, grant deadlines missed and the pressure to pay that follows. A restore test that measures hours to recover a representative research server gives leaders a number they can use in a crisis.

Central IT cannot impose this on departments overnight. A workable model offers departments a funded central backup service, sets a minimum standard for any server holding sensitive or irreplaceable data, and gives the chief information security officer authority to enforce it. Exceptions should be recorded and approved by the dean or department chair who owns the risk.

Data exposure: the cost of publication

By 2020, many ransomware groups combined encryption with data theft and threatened to publish what they took. Good backups do not remove that pressure. An organization might still face release of unpublished research, personnel files or patient information. Paying for deletion gives no reliable assurance, because the victim cannot verify that data was destroyed or that no copies remain.

The advance decision here is data placement. Knowing where sensitive data sits, limiting copies and restricting what any single environment can reach all reduce what an attacker can take. Research groups that keep identifiable patient data on departmental servers create exactly the exposure that makes extortion effective. Moving such data to managed research environments, with access logging, cuts both the likelihood and the impact. Notification duties under HIPAA and state breach laws apply if protected information is affected, whether or not a ransom is paid. Payment does not remove the regulatory work, and it does not shorten the forensic review needed to scope it.

Financing: who pays and on what terms

Cyber insurance often shapes the response. Policies may cover incident response, negotiators, ransom payments and business interruption, and they usually come with panels of approved firms. Policy terms decide what help arrives and how quickly. Exclusions and conditions, such as requirements for multi-factor authentication or tested backups, decide whether a claim is paid at all.

These are procurement decisions. Before an incident, an organization should know which forensic firm, negotiator and outside counsel it will call, and whether the insurer has approved them. It should know what the policy covers and excludes, and whether its own controls meet the policy’s conditions. Engagement letters signed in advance save days. University systems should also confirm whether coverage sits with the campus, the system office or a self-insurance program, since that determines who must approve spending during an attack.

Legal readiness: the process for deciding and reporting

Any payment raises sanctions, law enforcement and regulatory questions. Counsel needs a defined process for checking the recipient before money moves, and the procurement point is simply that the process and the advisers should exist before they are needed. Reporting obligations run on separate clocks. An academic medical center may owe notices to a hospital regulator, research sponsors, a university system office and affected individuals at once. A short matrix of those obligations, agreed with counsel in advance, saves time and keeps one notice from contradicting another.

Boards of health systems and research institutions can bring the four inputs together in a ransom policy agreed before any attack. It should state the circumstances in which payment would be considered, who decides, which advisers are engaged and what evidence is required. That policy will not make the decision easy. It does ensure that leaders arrive at it knowing their recovery time, their data exposure, their coverage and their obligations.

With hindsight

In October 2020, the Treasury Department warned that facilitating ransomware payments to sanctioned parties could violate sanctions regulations, a development examined later in this series. In January 2021, the Justice Department announced a coordinated action against NetWalker, including seizure of a dark web site used to publish victims’ data and charges against an affiliate.

Cyber insurance markets tightened sharply in 2021 and 2022. Insurers raised premiums and made multi-factor authentication and tested backups conditions of cover, which turned the advance decisions described here into underwriting questions. Health care remained one of the most targeted sectors. In the 2024 Change Healthcare attack, a ransom was reportedly paid and data was still exposed, confirming that payment does not guarantee the outcome it is meant to buy.