Navigating Chaos: A Prison's Struggle with Ransomware and Legacy Systems

The talk examines a ransomware attack on a prison's IT environment, which ran on decades-old systems with weak patching, no structured incident response plan, and little hardening. A single phishing email, most likely opened by someone in the medical unit, gave attackers a foothold. From there they moved across the network using ordinary techniques such as mapped drives, because segmentation was lacking and nothing monitored the activity. Old documents containing personal data sat in user folders and file shares, and the attackers collected them freely.

The speaker describes how the response made the situation worse. Staff wiped systems instead of preserving evidence, logging was minimal, and backups were encrypted because they were reachable from compromised machines. Warnings from the attackers, including a sample leak and direct contact with the front desk, were ignored. Around 250 GB of data was later published on the dark web, and the talk outlines the resulting legal and compliance fallout under criminal justice and health data rules.

The remedies offered centre on timely patching, a tested response plan, phishing-focused staff training, network segmentation, offline backups and continuous monitoring. The speaker argues that security needs funding and a place at leadership level rather than sitting under facilities management. The takeaway for practitioners is that basic controls could have prevented or limited this breach, and that under-resourced institutions in similar positions can benefit from outside expertise.