Why it matters / Mission continuity
Behind every system.
A person who needs it.
Ransomware reaches beyond encrypted servers. It reaches the records, results, and workflows that care teams depend on. Security operations need to see that connection.
Explore the path to impact01 / Follow the signal
The quiet middle
deserves attention.
An intrusion can develop through several stages before a major outage. Select a stage to explore the evidence and the questions it raises.
Illustrative investigation path
A conceptual sequence. Real incidents differ.An ordinary-looking entry point.
A phish, stolen credential, or exposed remote portal can give an attacker an initial foothold. The first useful question is who signed in, from where, and to which system.
- Evidence to connect
- Identity activity · Remote access · Endpoint context
- The analyst’s question
- Is this access consistent with the identity’s expected work?
Read the complete illustrative sequence
Initial access
A phish, stolen credential, or exposed remote portal can give an attacker an initial foothold. The first useful question is who signed in, from where, and to which system.
Question to ask: Is this access consistent with the identity’s expected work?
Credential theft
Compromised credentials can let activity appear legitimate. Investigating privilege changes and relationships between accounts and endpoints helps reveal the scope of access.
Question to ask: What else can this identity reach?
Lateral movement
Movement between systems matters most when it approaches patient records, imaging, laboratory, or identity services. A linked investigation can show why several small signals deserve attention together.
Question to ask: Does this path connect to a care-critical service?
Data staging
Unusual access and collection activity may put protected information at risk before encryption. Analysts need an evidence trail that connects the identity, the affected systems, and the observed activity.
Question to ask: What information may be exposed, and what supports that assessment?
Operational impact
Encryption or extortion can force systems offline and interrupt clinical or administrative workflows. Containment decisions need an accountable person who can weigh security evidence alongside continuity requirements.
Question to ask: Who can approve the response, with which operational constraints?
02 / Understand the dependency
One connected environment.
Different consequences.
Select a care system. See why its operational role belongs beside the technical evidence.
CARECONTINUITY
Patient records
Context for every care decision.
Patient records connect clinical teams to histories and treatment information. Investigations should make the relationship between an affected identity and these records visible.
Review access scope, related identities, and the clinical workflow before proposing containment.
Illustrative dependencies for a briefing; not a live network or a product integration claim.
The consequences
are human.
03 / Public incident record
What actually happened.
Three documented incidents. Open each summary to read the public record and the operational lesson.
01February 2024Change Healthcare
Identity → lateral movement
UnitedHealth’s May 2024 congressional testimony described entry through compromised credentials on a Citrix portal without multi-factor authentication. Attackers moved laterally and exfiltrated data; ransomware followed nine days after initial access. The incident disrupted healthcare transactions and access to claims and payment workflows.
An entry event can become a path across systems before a disruptive payload appears. Identity context and connected evidence belong in the same investigation.
02June 2024Synnovis / NHS London
Pathology → clinical continuity
The cyber incident at pathology provider Synnovis disrupted services supporting NHS trusts in London. Official NHS updates continued to report postponed outpatient appointments and elective procedures eight weeks after the attack.
A service provider can be a dependency for many care teams. Security investigations need to connect technical impact to the workflows that rely on that service.
03May 2025Covenant Health
Unauthorized access → patient information
Covenant Health reported unusual IT activity on May 26, 2025. Its investigation found that an unauthorized party had gained access on May 18 and could access some patient information, potentially including treatment and health insurance details.
The interval between unauthorized access and discovery matters. Investigators need to correlate activity and understand which information and systems were in scope.
Public incidents are not customer case studies. These lessons do not imply that CENTARGUS would have prevented a specific event. Photography illustrates healthcare settings.
04 / Questions worth asking
More context.
Better decisions.
Lean security teams need a connected view of what threatens the mission, and a clear place for human judgment.
01Why can hospital attacks develop before a major outage?
A stolen credential or compromised endpoint can create an opening before ransomware becomes visible. Correlating identity, endpoint, and network activity helps analysts investigate how that access connects to important clinical systems. The timing and sequence vary by incident.
02What is CENTARGUS designed to change?
CENTARGUS is designed to connect security signals to identity and high-value systems, help analysts investigate relevant paths, and require human approval for critical containment actions. These design goals do not mean that any particular historical attack would have been prevented.
03Why should clinical context influence security decisions?
A system can support imaging, laboratory results, patient records, or identity services. Analysts need to consider those dependencies before proposing containment. The goal is to support informed human decisions with both security evidence and mission context.
04Which public incidents help explain the risk?
Change Healthcare in February 2024, the Synnovis pathology incident in June 2024, and Covenant Health in May 2025 illustrate different consequences of cyber intrusion. The summaries on this page link to congressional testimony and official healthcare organization updates; they are not CENTARGUS customer case studies.