INITIAL RESPONSE

In a ransomware situation, computers and devices can become rapidly locked, preventing their clinical and business use. The attacker may display threats and payment demands on the computer screen: :

• Contact the Help Desk (312) 227-3445 and give location
• Contact the Help Desk (312) 227-3445 and give location
• IM will confirm a cyber alert situation
• An Everbridge Mass Notification will be sent to all staff stating “Cyber Security Alert. Containment in Progress Activate departmental downtime procedures.”
• Incident Command will be activated
• Activate department-specific downtime procedures

SECONDARY RESPONSE

& FOLLOW UP

• Communications will be shared with staff, patients & families, and the public via our Public Information Officer as it becomes available.
• IM will advise when access to devices, networks, and applications is restored.
• Once cleared to do so, an Everbridge Mass notification will be sent to all staff stating, “Cyber Security Alert. Restoration in progress Computer equipment and devices are safe to use the following services are available at this time ”