Carelink Health runs 14 clinics where downtime directly affects patient care. A small IT team could not watch every alert overnight, and legacy clinical devices limited what could be patched quickly.
After seeing similar providers hit by ransomware, Carelink partnered with us to add round-the-clock detection and response without having to build its own security operations center.
Detection
At 2:14 a.m., behavioural detection flagged unusual credential use and file access on a clinic workstation. An analyst confirmed the pattern within minutes as the early stage of a ransomware deployment.
Containment
Using pre-approved playbooks, the analyst isolated the affected hosts and disabled the compromised account. Because these actions had been agreed in advance, nobody needed to wait for a morning call or an approval chain.
Results
The attack was contained across 14 clinics before a single file was encrypted, and no clinical systems went offline. The investigation traced entry to a phished account, prompting a faster rollout of stronger MFA across the group.
We found out about the attack from the report telling us it had already been stopped. Patient care never paused.
Recommended Projects
Stay Protected With Next-Generation Security
Protect your data, apps and users with 24/7 monitoring, fast incident response and audit-ready security built for growing teams.