In early 2024, Change Healthcare was struck by ransomware. Claims processing halted. Pharmacies stalled. Patients were affected nationwide. A $22M ransom was paid, yet full functionality didn’t return until nearly a year later.
It wasn’t just a security issue. It was a recovery issue.
Most health systems today depend on centralised vendors like Change for infrastructure and payments. But few assess those vendors with the same scrutiny as internal assets. When Change Healthcare failed, a wide swath of U.S. hospitals failed along with it.
The company had backups. But those backups weren’t fast to deploy. Dependencies weren’t documented. Internal teams weren’t empowered. This wasn’t just about the malware. It was about the lack of recovery design.
In data recovery services, speed is currency. And trust is perishable. No amount of ransom payment can buy back lost months.
The breach emphasised the need for tabletop restoration drills, accessible off-site backups, and continuity plans that include third-party failure.
Downtime isn’t theoretical. It’s operational collapse. And it must be planned for long before the breach ever happens.
Sameer Malik is the Founder and Managing Director of Brigient, a boutique cybersecurity advisory firm based in Mississauga, Ontario. With over 20 years of experience in cybersecurity, governance, risk management, and IT strategy, Sameer has led more than 300 incident and ransomware response engagements for organizations across Canada. He holds a BA from the University of Toronto and is certified in TOGAF® 9 (The Open Group Architecture Framework) and ITIL (IT Infrastructure Library). Sameer's approach to cybersecurity is built on four pillars: Identify, Respond, Recover, and Govern.