What Hive’s victims gained by calling the FBI early
When federal agencies warned health care about Hive ransomware, the FBI had secretly held the group’s decryption keys for months. Victims who reported got them. Health systems should settle when to call, what to share and how reporting fits other clocks.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On November 17, 2022, the FBI, CISA and the Department of Health and Human Services published a joint advisory on Hive ransomware. It said that, as of November 2022, Hive actors had victimized more than 1,300 companies worldwide. They had received about 100 million dollars in ransom payments since the group appeared in June 2021, with health care and public health among the sectors hit. The advisory described common entry methods: single-factor logins to remote desktop and VPN services, exploitation of known flaws in Fortinet and Microsoft Exchange products, and phishing. It described Hive’s practice of stealing data before encrypting systems and threatening to publish it. It urged organizations to patch, require multi-factor authentication and report incidents to the FBI or CISA.
Read in November 2022, the Hive advisory looked routine: a group profile, indicators of compromise and familiar advice. Its closing request, to report incidents, read like boilerplate. Two months later the Justice Department revealed that the FBI had been inside Hive’s infrastructure since July 2022. It had obtained decryption keys and given them to victims around the world, sparing many from paying. When the advisory asked victims to report, the FBI could often offer something concrete in return.
Health systems hesitate to call law enforcement for understandable reasons: fear of losing control of the response, of publicity, or of delay. Hive is the strongest evidence that the hesitation can be costly. It also shows that a sound reporting policy has to work without knowing what law enforcement holds, because no victim in late 2022 knew. Three decisions make up that policy: when to call, what to share, and how reporting fits alongside the insurer, counsel and regulatory clocks that start at the same time.
When to call
The useful answer is early, and it is easier to act on if it is decided in advance. A written trigger helps: confirmed ransomware, a ransom note, or evidence of data theft prompts a call to the FBI within hours, made by a named person with a named deputy. Waiting until the scope is clear defeats the purpose, since keys and intelligence matter most before systems are rebuilt or a ransom is negotiated.
The call is easier when someone already knows who to ring. Health systems that had met their local FBI field office before an incident, through outreach programs or sector exercises, could reach an agent quickly. Those making a cold call through a public tip line started further back. Building that relationship costs a meeting or two a year.
Early contact does not hand over the response. Law enforcement does not take control of a victim’s network or decide whether to restore or pay. Making that clear in the incident plan, and to executives who fear it, removes one common reason for delay.
The trigger should not depend on the recovery path. A hospital confident in its backups may see little reason to call, and one leaning toward payment may fear scrutiny. Both have reasons to report. For the first, its indicators help other victims and may reveal whether data was stolen. For the second, a payment to a sanctioned party carries its own legal risk that agents and counsel can help assess.
What to share
The FBI can help most when it receives specifics. Useful items include the ransom note and the attacker’s contact channel, sample encrypted files, and indicators such as IP addresses and file names. The entry point, if known, and any cryptocurrency wallet addresses used in negotiations also help agents match the incident to known infrastructure. In Hive’s case, that matching was what allowed keys to reach victims.
Sharing raises legitimate concerns about privilege and confidentiality. Incident response firms often work under the direction of outside counsel to protect their findings. Counsel can agree in advance what technical information goes to law enforcement and how, so the decision is not made under pressure on the first night. Technical indicators rarely contain protected health information, and they can be separated from forensic reports that do.
The flow runs both ways. Agents may share indicators from other victims that help the hospital’s responders find the attacker’s footholds. That only happens when someone on the hospital side is authorized to receive and act on it.
Evidence has to survive long enough to be shared. Responders under pressure to restore service may wipe and rebuild servers before images are taken. A short rule, such as capturing memory and disk images from a sample of affected systems before rebuilding, keeps that option open at modest cost in time.
How reporting fits the other clocks
A ransomware incident at a health system starts several processes at once. The cyber insurer typically requires prompt notice and may appoint the response firm and a negotiator. Counsel begins assessing notification duties under HIPAA and state law, which have their own timelines once a breach of protected health information is discovered. Executives, the board and sometimes state health departments need briefings.
Law enforcement reporting is separate from regulatory notification. Calling the FBI does not satisfy HIPAA breach notification, and HIPAA notice does not inform the FBI. The incident plan should set out each obligation, its owner and its clock on one page, so the reporting decisions do not compete for the same people’s attention in the first hours.
Insurers need to be aligned in advance. Most carriers encourage law enforcement contact, but policy terms and panel firms vary. Reviewing the policy with the broker, and confirming that early FBI contact is consistent with its conditions, avoids a dispute when time matters most.
The entry points in the advisory deserve a final word, because they set how often this policy is tested. Single-factor remote access, unpatched internet-facing systems and phishing drove most of Hive’s intrusions. Multi-factor authentication on every remote path, including vendor support access, and fast patching of known exploited flaws reduce the number of calls a hospital ever has to make.
With hindsight
In January 2023, the Justice Department announced that the FBI, working with international partners, had dismantled Hive’s infrastructure after months of covert access. It said the FBI had provided more than 300 decryption keys to victims under attack and more than 1,000 to earlier victims, preventing about 130 million dollars in ransom payments. Other groups filled the gap, and 2024 brought the largest disruption the U.S. health sector had seen, the attack on Change Healthcare. Law enforcement mounted further disruptions, including the February 2024 operation against LockBit, which also yielded decryption keys. Mandatory reporting moved forward slowly. CISA’s proposed rule under the 2022 federal incident reporting law, published in 2024, would require many hospitals to report significant incidents and ransom payments, but its final form has been repeatedly delayed. By 2026, Hive remains the clearest case of what reporting early returned.