Ransomware risk for a nursing home in France: what are we actually putting on the line with health data?

Attackers deliberately target healthcare and care facilities because they know an e-commerce site losing access for two days just loses money, but a care home losing access for even an hour risks lives. They know you'll be desperate, which makes you much more likely to pay the ransom. Your technician's attitude is dangerously reckless.

Antivirus only looks for known signatures; ransomware typically breaches systems via zero-day vulnerabilities or stolen credentials. Audit the network shares (SMB) on your local server. If your backup drive is mapped to the main network, attackers will wipe or encrypt those backups first before locking the primary system.

First thing Monday morning, ask your technician: "When was the last time we tested restoring a backup onto a clean machine?" If it hasn't been tested, you don't have a backup. Second, run a manual backup to an external drive and lock it in a physical safe.

This happened to an acquaintance working at a similar 50-bed clinic in France. A single employee opened a fake invoice attachment, and the entire server got locked down. The ARS and the gendarmerie cyber unit got involved, it took 19 days to restore the systems, and external consulting costs ran up to 28,000 EUR.

Are your medical devices or bedside monitors on the same local network? If your office PCs and medical database share the same subnet (VLAN), malware hitting an accounting computer will spread to the entire patient care system within minutes.

You can't expect real cybersecurity expertise from a tech paid 800 EUR a month; they're probably just setting up printers and renewing Office licenses. Anyone who says "we have antivirus, nothing will happen" should never be trusted with healthcare infrastructure security. You need an independent audit.

Under the French Public Health Code and RGPD, if special category data is lost or compromised, you are legally obligated to formally notify not just the CNIL, but also the affected residents themselves or their legal guardians in writing.

Last year a nursing home in a neighboring department was hit on a Sunday night. They told me directly that staff panicked Monday morning because no one had memorized the residents' blood pressure meds or insulin doses. If your emergency paper charts aren't ready, the cost of that day's chaos will dwarf any regulatory fine.

Good call starting this thread. When we decide without measuring, we always end up in the same place.

saved.

The opposite happened to me, that's why I'm writing. An automated scan report is not the same as a penetration test.

Don't hesitate to ask; those who don't ask always pay more.

Let me summarize the topic, since several different answers were given. The real issue isn't the number, but what it's based on.

When making decisions, write down the worst-case scenario too, not just the best. Just leaving this note, it might be useful.

My questions are cleared up, thanks. The biggest time-waster for us was not knowing who had the final say.

The real issue isn't the number, but what it's based on. If I were you, I'd go this route.

i went through the same thing two years ago and if you dont write this down from the start, it leads to arguments later.

if you don't write this down from the start it leads to arguments later. just leaving this note, it might be useful.

The answer above hits the nail on the head. Most time waste accumulates in tasks waiting for approval.

If you have questions, write them; I'll answer as best I can.

Could you elaborate on that? Don't hesitate to ask; those who don't ask always pay more.

Any unwritten clause becomes a point of disagreement later as both sides remember it differently. Of course, it varies if your situation is different.

To get into the details: Dont hesitate to ask; those who dont ask always pay more.

Let me clarify the technical side. I mean taking notes for two weeks yields better results than a six-month estimate.

People defend habits, not processes. Resistance comes from there.