What Hive’s victims gained by calling the FBI early

The week

On November 17, 2022, the FBI, CISA (the federal Cybersecurity and Infrastructure Security Agency) and the Department of Health and Human Services published a joint advisory on Hive ransomware. Its subject was the moment a hospital meets at 2 a.m., when screens across the building show the same message: files are locked, and a payment is demanded to unlock them. Clinicians switch to paper, executives are woken up, and somebody has to decide, quickly, whom to call.

Ransomware is malicious software that scrambles, or encrypts, an organization’s files so they cannot be used, followed by a demand for payment in exchange for the key to unscramble them. Hive was one of the criminal groups running it. The advisory said that, as of November 2022, Hive actors had victimized more than 1,300 companies worldwide. They had received about 100 million dollars in ransom payments since the group appeared in June 2021, with health care and public health among the sectors hit.

Health care already knew the name. In August 2021, within weeks of Hive’s appearance, an attack attributed to the group hit Memorial Health System in Ohio, forcing it to divert emergency patients and cancel procedures while it worked on paper. HHS was a co-author of the November advisory, and the document singled out the health and public health sector for particular attention.

The advisory explained how Hive was organized. It ran as ransomware-as-a-service: a core group of developers built and maintained the malware and the payment and leak websites, while affiliates carried out the attacks and shared the proceeds. That model explains why intrusions varied. Different affiliates used different routes in, but every victim ended up dealing with the same central infrastructure for negotiation and decryption.

The advisory described how Hive typically got in. The first route was single-factor logins to remote desktop and VPN services. Those are the tools staff and vendors use to reach an organization’s systems from outside; “single-factor” means a password alone, with no second check such as a code on a phone. The second was exploitation of known flaws in Fortinet and Microsoft Exchange products, widely used network security and email systems that had published fixes some organizations had not applied. One of the Fortinet flaws let attackers skip the second login factor simply by changing the capitalization of a username. The third was phishing, deceptive emails that trick someone into revealing a password or opening a malicious file.

Once inside, the advisory said, Hive actors worked to remove the victim’s ways back. They stopped backup and antivirus processes, deleted the Windows shadow copies that allow quick file recovery, and cleared system event logs that investigators would later need. Versions of the malware targeted Windows, Linux, FreeBSD and VMware ESXi, the software that runs many virtual servers in hospital data centers.

It also described Hive’s practice of stealing data before encrypting systems and threatening to publish it. That tactic, sometimes called double extortion, means that even an organization able to restore everything from backups may still face a demand to keep patient or customer records off the internet. The ransom note pointed victims to a live chat site, which Hive called its sales department, and threatened publication on a leak site the group named HiveLeaks. Some victims who restored from backups without paying were attacked again.

The theft itself used ordinary tools. The advisory said Hive actors likely combined Rclone, a legitimate program for copying files to cloud storage, with the file-sharing service Mega. Because those tools have lawful uses, large outbound transfers to cloud storage are one of the few signs a hospital can watch for before encryption starts. Ransom demands ranged, the advisory said, from several thousand dollars to millions, payable in Bitcoin.

The document was part of CISA’s #StopRansomware series of joint advisories, each profiling one group with its methods and technical indicators, and CISA posted a revised version on November 25.

The advisory urged organizations to patch, require multi-factor authentication and report incidents to the FBI or CISA. It said the agencies did not encourage paying a ransom, since payment did not guarantee recovery, and asked victims to report promptly whether or not they paid. At the time, that last request looked like standard advice. It turned out to matter far more.

Read in November 2022, the Hive advisory looked routine: a group profile, indicators of compromise and familiar advice. Its closing request, to report incidents, read like boilerplate. Two months later the Justice Department revealed that the FBI had been inside Hive’s infrastructure since July 2022. It had obtained decryption keys and given them to victims around the world, sparing many from paying. When the advisory asked victims to report, the FBI could often offer something concrete in return.

Health systems hesitate to call law enforcement for understandable reasons: fear of losing control of the response, of publicity, or of delay. Hive is the strongest evidence that the hesitation can be costly. It also shows that a sound reporting policy has to work without knowing what law enforcement holds, because no victim in late 2022 knew. Three decisions make up that policy: when to call, what to share, and how reporting fits alongside the insurer, counsel and regulatory clocks that start at the same time.

The sections below begin with how an attack unfolds, since each stage shapes those decisions. They then take the three decisions in order and follow two versions of the same first night. They close with the shape of a sound policy and why the call is an executive decision rather than a technical one.

How an attack unfolds

Each stage of an attack shapes the decisions that follow.

First, the attacker gets in, usually through one of the routes the advisory listed: a weak remote login, an unpatched system facing the internet, or a phishing email. Then, often over days or weeks, the attacker moves through the network unnoticed, gathering passwords and finding the most valuable systems and data. This stage is sometimes called lateral movement, and it resembles a burglar who enters through an unlocked side window and then walks from room to room collecting keys.

Next comes the theft. Before doing anything visible, groups like Hive copy sensitive data out of the organization. Only then do they trigger the encryption, locking files and systems all at once, and leave a ransom note with instructions for making contact and paying, usually in cryptocurrency.

The key to unlocking the files is a decryption key, a piece of code held by the attacker. Without it, the organization has two main options. It can restore systems from backups, which can take days or weeks for a large hospital. Or it can pay and hope the key works and the stolen data is not published anyway.

Backups deserve a note of their own. They are copies of systems and data kept so an organization can restore after a disaster. Attackers know this, and many try to find and destroy backups before triggering encryption. Even intact backups take time to restore at the scale of a hospital. That is one reason a working key can matter so much, and stolen data remains a problem no backup can solve.

Indicators of compromise, a phrase that appears in nearly every advisory, are the fingerprints an attack leaves behind: internet addresses the attackers used, names of the files they dropped, patterns of behavior. Sharing them helps other organizations check whether the same group is inside their networks, and helps investigators link incidents together.

For a hospital, the stakes are unusually direct. Electronic health records, imaging, laboratory systems and pharmacy systems all depend on the network. When they go down, care slows and becomes riskier, staff fall back on manual processes, and revenue stops flowing because billing systems are offline too.

Why the FBI could hold the keys

The ransomware-as-a-service model explains how investigators came to hold keys at all. A group like Hive needs to sell decryption to paying victims, so it keeps the keys for each victim on its own infrastructure, linked to that victim’s negotiation and payment records. Affiliates come and go; the central servers stay. Anyone with access to those servers can, in principle, retrieve a victim’s key without paying.

That is what the FBI did. It had covert access to Hive’s infrastructure from late July 2022, and could retrieve keys as new victims were hit. The obstacle was matching. A key is useful only if investigators know which victim it belongs to and can reach that victim before systems are rebuilt or a ransom is paid. Victims who did not report were, in effect, invisible to the people holding their keys.

How the stages play out by type of provider

The same attack lands differently depending on the organization. A large health system runs many hospitals on shared infrastructure, so an attacker who reaches its virtual server platform can encrypt hundreds of servers at once. The advisory’s note that Hive had a version for VMware ESXi matters here: that one platform may host the electronic health record’s supporting systems, imaging archives and business applications together.

A rural or critical access hospital usually has a small IT team, often with its electronic health record hosted by a vendor or a larger partner. Its first problem is capacity. It may not have anyone awake at 2 a.m. who can tell ransomware from an outage. An ambulatory network or physician group, often supported by a managed service provider, may find that the provider’s remote management tools were the attacker’s path in. Each of these needs the same three decisions, but who makes them, and how fast, differs.

When to call

The useful answer is early, and it is easier to act on if it is decided in advance. A written trigger helps: confirmed ransomware, a ransom note, or evidence of data theft prompts a call to the FBI within hours, made by a named person with a named deputy. Waiting until the scope is clear defeats the purpose, since keys and intelligence matter most before systems are rebuilt or a ransom is negotiated.

Why hours rather than days? Because the first hours are when choices narrow. Servers get wiped, negotiators open conversations, executives form views about paying, and every one of those steps is harder to reverse than to delay. A call made early keeps more options open. If investigators hold a key or know the group’s habits, that knowledge can shape the response from the start. Otherwise it arrives after money has changed hands or evidence has been erased.

The call is easier when someone already knows who to ring. Health systems that had met their local FBI field office before an incident, through outreach programs or sector exercises, could reach an agent quickly. Those making a cold call through a public tip line started further back. Building that relationship costs a meeting or two a year.

Early contact does not hand over the response. Law enforcement does not take control of a victim’s network or decide whether to restore or pay. Making that clear in the incident plan, and to executives who fear it, removes one common reason for delay.

The trigger should not depend on the recovery path. A hospital confident in its backups may see little reason to call, and one leaning toward payment may fear scrutiny. Both have reasons to report. For the first, its indicators help other victims and may reveal whether data was stolen. For the second, a payment to a sanctioned party carries its own legal risk that agents and counsel can help assess. (A sanctioned party is a person or group the government has barred from receiving payments; paying one can be unlawful even under duress.)

The sanctions angle, in more detail

The Treasury Department’s Office of Foreign Assets Control updated its advisory on ransomware payments in September 2021. It warned that facilitating a payment to a sanctioned person can violate US sanctions law, including for insurers, negotiators and response firms acting for a victim. It also said that a full and timely report to law enforcement, made on the victim’s own initiative, would weigh heavily in the victim’s favor. So would full cooperation, if a violation later came to light.

That makes early reporting relevant even to a hospital that expects to pay. Ransomware groups change names and share members, and whether a particular payee is sanctioned can be hard to determine on the first night. A documented early report is part of the record a hospital would want if the question were ever asked. The specific analysis belongs with sanctions counsel.

Whom else to call, and in what order

The FBI is one of several first calls. The advisory named the local field office or CISA as reporting routes, and the two agencies share information with each other. Many hospitals also notify their information sharing organization, such as Health-ISAC, to warn peers, though that is voluntary. Public hospitals owned by a county or state may have reporting duties to state agencies under state law, which counsel should map in advance.

The order matters less than the fact that each call has an owner. A practical sequence puts the cyber insurer and outside counsel first, because the policy and privilege often depend on them, and law enforcement within the same few hours. None of the calls should wait on another being finished.

The case for waiting, and why it fails

Some executives argue for waiting a day: the scope is unclear, the facts may change, and a premature report could prove embarrassing or wrong. Those concerns are reasonable for public statements. They do not apply to a confidential call to investigators, who expect early reports to be incomplete and work with what they are given.

The stronger objection is that reporting adds work at the worst moment. A team stretched by restoration may resent hours spent answering agents’ questions. The answer is preparation. If counsel has already agreed what to share and a named person handles the contact, the burden on responders is small. The work that cannot be compressed, such as rebuilding systems, does not change.

What to share

The FBI can help most when it receives specifics. Useful items include the ransom note and the attacker’s contact channel, sample encrypted files, and indicators such as IP addresses and file names. The entry point, if known, and any cryptocurrency wallet addresses used in negotiations also help agents match the incident to known infrastructure. In Hive’s case, that matching was what allowed keys to reach victims.

If the FBI already holds keys for a particular group’s infrastructure, the details from a victim are what tell agents which key fits.

Sharing raises legitimate concerns about privilege and confidentiality. Incident response firms often work under the direction of outside counsel to protect their findings. Counsel can agree in advance what technical information goes to law enforcement and how, so the decision is not made under pressure on the first night. Technical indicators rarely contain protected health information, and they can be separated from forensic reports that do.

Privilege, in this context, is the legal protection that can keep communications with lawyers, and work done at their direction, out of later lawsuits. Protected health information is the patient data that HIPAA, the federal health privacy law, governs. Neither needs to be put at risk by sharing an IP address or a ransom note.

A sharing package prepared in advance

The simplest way to make sharing fast is to define the package before any incident. A one-page template can list the items to collect and send:

• the ransom note, in its original file, and any identifier or login it contains for the attacker’s chat site;
• a few sample encrypted files, and unencrypted originals of the same files if backups hold them;
• internet addresses, domain names and file names already identified as malicious;
• the suspected entry point and the approximate time of first access;
• any cryptocurrency addresses or contact details the attackers have provided.

Counsel approves the template once. On the night, the incident lead fills it in and sends it through the agreed channel. Anything outside the template, such as forensic findings or patient data, goes through counsel first.

What happens to what is shared

Executives often worry that information given to the FBI will surface in public. The bureau does not generally publicize the names of victims who report, and agents are used to working alongside a victim’s counsel and response firm. Technical indicators may be passed, without the victim’s name, to other agencies and to industry in later advisories. That is how the Hive advisory itself came to contain the indicators it did: earlier victims had reported them.

A hospital should still assume that anything it shares could appear in court if charges are ever brought, and decide what to share on that basis. Counsel can explain how the material would be handled. For most technical items, such as addresses, file names and a ransom note, the risk to the hospital is low and the value to investigators is high.

The flow runs both ways. Agents may share indicators from other victims that help the hospital’s responders find the attacker’s footholds. That only happens when someone on the hospital side is authorized to receive and act on it.

Evidence has to survive long enough to be shared. Responders under pressure to restore service may wipe and rebuild servers before images are taken. A short rule, such as capturing memory and disk images from a sample of affected systems before rebuilding, keeps that option open at modest cost in time. An image is a complete snapshot of a computer’s contents at a moment in time.

The trade-off between evidence and restoration

The evidence rule has a cost. Every hour spent imaging is an hour a clinical system stays down, and in a hospital that hour is felt by patients. The way through is to sample rather than image everything: a domain controller, a file server, one or two affected workstations and any system that shows the entry point. Those few images usually hold most of what investigators need, and the rest of the estate can be rebuilt at full speed.

Hive’s habit of deleting event logs makes this more important. If the attacker has cleared the logs on a server, memory and disk images may be the only remaining record of what happened there. A hospital that also sends logs to a separate system, out of the attacker’s reach, keeps a second record that survives.

How reporting fits the other clocks

A ransomware incident at a health system starts several processes at once. The cyber insurer typically requires prompt notice and may appoint the response firm and a negotiator. Counsel begins assessing notification duties under HIPAA and state law, which have their own timelines once a breach of protected health information is discovered. Executives, the board and sometimes state health departments need briefings.

Law enforcement reporting is separate from regulatory notification. Calling the FBI does not satisfy HIPAA breach notification, and HIPAA notice does not inform the FBI. The incident plan should set out each obligation, its owner and its clock on one page, so the reporting decisions do not compete for the same people’s attention in the first hours.

The clocks, side by side

Each clock runs on its own rules. Under the HIPAA Breach Notification Rule, a covered entity must notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach. Breaches affecting 500 or more people also require notice to HHS and, for residents of a state or jurisdiction, to prominent media outlets. A business associate that suffers the breach must notify the covered entity, which then carries the duty to notify individuals.

HHS guidance since 2016 has said that ransomware encrypting protected health information is presumed to be a breach. The presumption holds unless the organization can show, through a documented risk assessment, a low probability that the information was compromised. Hive’s practice of stealing data first makes that showing harder. State breach laws add their own deadlines and definitions, and they differ.

Publicly traded health companies have another clock. Since December 2023, SEC rules have required them to disclose a cybersecurity incident on Form 8-K within four business days of determining that it is material. That rule applies to listed companies, not to nonprofit health systems, which make up much of the hospital sector.

Where reporting and notification meet

One provision links the clocks directly. The HIPAA breach rule lets a covered entity delay notification if a law enforcement official says notice would impede a criminal investigation. An oral statement supports a delay of up to 30 days; a written statement can set a longer period. That provision only helps an organization that has been in contact with law enforcement, and it should be documented carefully. Counsel should handle any such request.

Insurers need to be aligned in advance. Most carriers encourage law enforcement contact, but policy terms and panel firms vary. Reviewing the policy with the broker, and confirming that early FBI contact is consistent with its conditions, avoids a dispute when time matters most. A panel firm is an incident response or legal firm the insurer has pre-approved; using one is often a condition of coverage.

One owner for the map

The one-page map needs a single owner, usually the general counsel or chief compliance officer, who keeps it current between incidents. Each line names the obligation, the trigger, the deadline, the owner and the deputy. During an incident, the map becomes a status board: which notices have gone, which are pending and which depend on facts still being established. A health system operating in several states will have a longer map, and should review it whenever it acquires a hospital or enters a new state.

The entry points in the advisory deserve a final word, because they set how often this policy is tested. Single-factor remote access, unpatched internet-facing systems and phishing drove most of Hive’s intrusions. Multi-factor authentication on every remote path, including vendor support access, and fast patching of known exploited flaws reduce the number of calls a hospital ever has to make.

Multi-factor authentication asks for something beyond a password, such as a code from a phone app, before letting someone in. Vendor support access matters because many medical and business systems are maintained remotely by their suppliers, and those connections are easy to forget.

Two versions of the first night

Consider two versions of the same night at a hypothetical hospital.

In the first version, the hospital has no written trigger. The IT director discovers the ransom note at 2 a.m. and calls the chief information officer, who calls the chief executive. They debate whether to involve the FBI and worry it will mean agents in the building and a news story. They call the insurer, who appoints a response firm. By the time anyone thinks about law enforcement, it is two days later, several servers have already been wiped and rebuilt, and the ransom note’s details are buried in a negotiator’s email. Nobody has the authority to share technical details, so counsel spends another day deciding.

In the second version, the incident plan names the information security director as the person who calls the FBI, with a deputy. The director has met the local field office twice. At 2:30 a.m. the call is made. Counsel has already agreed which technical details can be shared, so the ransom note, sample files and indicators go over the next morning. Responders take images of a handful of affected servers before rebuilding. The insurer was told at renewal that early FBI contact would be part of the plan. A one-page sheet on the incident room wall lists every obligation, its owner and its deadline.

The week after

The two hospitals diverge further as the days pass. The first is still rebuilding a week later, with a negotiator in contact with the attackers and executives weighing a payment. Its breach analysis is starting from incomplete evidence, because the servers that would have shown what was taken have been wiped. Its notification clock is running regardless.

The second has a clearer picture. Its preserved images show the entry point and the scale of data taken. Its counsel has a documented record of law enforcement contact, which supports both the sanctions analysis and any request to delay notification. Whatever investigators can or cannot provide, the hospital has lost nothing by calling, and it is making the payment and notification decisions on better facts.

In late 2022, the second hospital might well have received a decryption key. The first would probably never have found out whether one existed.

The shape of a sound reporting policy

A sound policy, drawn from the points above, has a recognizable shape. It starts with a written trigger for calling law enforcement, with a named owner and deputy, and an existing relationship with the local FBI field office. Counsel has agreed rules about what technical information is shared, and how. A short evidence rule makes sure key systems are imaged before they are rebuilt, and a one-page map sets out every reporting obligation and its clock. Insurance terms have been checked so early law enforcement contact does not cause a coverage dispute. And every remote path has multi-factor authentication, backed by fast patching of known exploited flaws.

The usual failures mirror that list. Organizations wait until they understand the full scope before calling. They assume law enforcement will take over. They rebuild first and preserve evidence never. They treat FBI contact and HIPAA notification as interchangeable. And they leave vendor remote access protected by a password alone, because nobody considered it part of the hospital’s own network.

The cost of these failures is measured in days of downtime, ransom payments that might have been avoided, and uncertainty about whether patient data was stolen. Each of those has a direct effect on patients, staff, revenue and the hospital’s standing with regulators and its community.

Fitting the policy to the organization

A multi-state health system should name a lead FBI field office, usually the one nearest its headquarters or security operations, while knowing the offices near its other hospitals. A small rural hospital may not have a security director at all. Its named caller may be the IT manager, with the chief executive as deputy, and its contact with the FBI may run through a state hospital association or a regional exercise.

Organizations that rely on a managed service provider should write the provider’s role into the contract. The provider may be first to see the attack and may hold the logs and images investigators need. The contract should say that the provider preserves evidence on request, shares it through the hospital’s counsel and does not contact law enforcement or attackers on the hospital’s behalf without authority.

Business associates, such as billing companies and IT vendors that handle patient data, need the same policy for a different reason. When they are attacked, their covered-entity clients depend on them to report quickly and accurately. A hospital can ask its key business associates to confirm, in their agreements, that they have a law enforcement reporting procedure and will share relevant indicators.

Testing it before it counts

A tabletop exercise is the cheapest test. The scenario starts at 2 a.m. with a ransom note, and the participants work through the first six hours: who is called, in what order, what is shared and which clocks start. Inviting the local FBI field office to observe or take part builds the relationship at the same time. Most exercises reveal one of three gaps: an owner who did not know they were the owner, a deputy who has left, or an insurer condition nobody had read.

A decision made, or blocked, by executives

Law enforcement reporting can look like a detail for the security team, but the decision to call is usually made, or blocked, by executives in the first hours of a crisis. It therefore needs to be settled at leadership level beforehand.

The money is significant. Hive alone had collected about 100 million dollars in ransom payments by the time of the advisory. Every payment avoided is money that stays with the hospital, and every day of downtime avoided is a day of care delivered normally and claims billed on time. A decryption key received early can shorten recovery dramatically compared with rebuilding from backups.

The risk is broader than money. Patients may face delayed treatment. Staff working on paper for days are more likely to make mistakes and to burn out. Regulators will ask how the incident was handled, and a clear record of early, documented reporting helps answer them. Communities notice which hospitals came back quickly and which did not.

Reputation cuts in a direction many executives do not expect. Calling the FBI is rarely what makes an incident public; the outage itself usually does that. Being able to say that the hospital reported promptly and cooperated with investigators is a stronger position than explaining a delay.

The payment question does not change the call

Some leaders treat reporting and paying as opposite paths, as if calling the FBI rules out a payment. It does not. The advisory asked victims to report whether or not they paid, and the decision to pay remains the victim’s, within the law. A hospital that reports early and later decides to pay is in a better position than one that pays without reporting. It has a record for the sanctions analysis, and investigators may be able to say whether the group has a habit of withholding keys or publishing data anyway.

The reverse also holds. Reporting is no guarantee of a key, and most reports will not produce one. Its value lies in the options it keeps open and the record it creates, whichever way the payment decision goes.

What the board should approve

The board, or its audit or risk committee, does not need to approve the technical details. It should approve three things. Confirmed ransomware is reported to law enforcement within hours as a matter of policy. A named role has the authority to make that call without waiting for further approval. And the policy applies whether or not the organization later decides to pay. Approving those points in advance removes the debate from the first night and protects the person who makes the call.

The board should also expect a short report after each incident or exercise. It should say when law enforcement was contacted, what was shared, what came back and how long each step took. Over time those reports show whether the policy works as written.

Finally, there is a collective benefit. Each report adds to what investigators know about a group, and that knowledge is what made the Hive operation possible. A hospital that reports is helping the next victim, which in a sector as interconnected as health care may be a partner, a supplier or a neighbor.

Settling the call before the night it is needed

• Who calls the FBI if we are hit with ransomware tonight, and who calls if that person is unavailable?
• Have we met our local FBI field office, and do we have a direct number?
• Has counsel agreed in advance what technical information we can share with law enforcement?
• Do we have one page listing every reporting obligation, its owner and its deadline?
• Is every remote path into our network, including vendor support access, protected by multi-factor authentication?

Each of those questions has an owner who can answer it within a week. The first belongs to the chief information security officer, the second to the security team, the third to the general counsel, the fourth to compliance and the fifth to the infrastructure lead. A health system that collects those five answers, fixes the gaps and repeats the exercise each year has done most of what the Hive case suggests. The rest depends on the night itself.

With hindsight

In January 2023, the Justice Department announced that the FBI, working with international partners, had dismantled Hive’s infrastructure after months of covert access. It said the FBI had provided more than 300 decryption keys to victims under attack and more than 1,000 to earlier victims, preventing about 130 million dollars in ransom payments.

The details of the operation matched the mechanism described above. The FBI had been inside Hive’s network since late July 2022. Dutch police took control of backup servers in the Netherlands, German authorities took part, and Europol supported the work. On the day of the takedown, Hive’s leak site displayed a seizure notice naming agencies from many countries. The keys had been sitting on Hive’s own servers all along, waiting to be matched to the victims who owned them.

Those numbers put the advisory’s closing line in a new light. A request that read like boilerplate in November had been, for victims who acted on it, a route to recovering their systems without paying criminals. Victims who stayed silent had no way of knowing what help might have been available.

Other groups filled the gap, and 2024 brought one of the most disruptive attacks the U.S. health sector had seen, on Change Healthcare. Law enforcement mounted further disruptions, including the February 2024 operation against LockBit, which also yielded decryption keys. Once again, keys recovered by law enforcement could only help victims who could be found and matched to them.

The Change Healthcare case showed the limits of takedowns. The group behind it, known as ALPHV or BlackCat, had itself been disrupted by the FBI in December 2023, when the bureau released a decryption tool to its victims. The group kept operating and attacked Change Healthcare two months later. UnitedHealth Group, Change’s parent, confirmed it paid a ransom, and later put the number of people whose data was affected at about 190 million. Disruption helped earlier victims. It did not stop the next attack.

Regulators also looked closely at how the Change Healthcare attack was handled. In March 2024 the HHS Office for Civil Rights announced that it was investigating, citing the scale of the attack. The episode put the one-page map of obligations to a hard test across thousands of providers, many of them working out who would notify their patients when a vendor was breached.

Mandatory reporting moved forward slowly. CISA’s proposed rule under the 2022 federal incident reporting law, published in 2024, would require many hospitals to report significant incidents and ransom payments, but the final rule has taken longer than first planned. The law itself sets the windows: 72 hours for a covered cyber incident and 24 hours after a ransom payment. Until the rule takes effect, reporting to law enforcement remains largely a choice, which means it depends on the decisions a hospital makes in advance.

When the rule arrives, it will settle whether covered hospitals must report to CISA. It will not settle how fast to call the FBI, what to share or how to coordinate with insurers. Those remain policy choices for each organization.

Looking across those years, one part of the 2022 picture held up and one did not. Reporting early did return value, in Hive and again in later disruptions that released keys. Takedowns did not shrink the problem for long: groups reformed, renamed and returned, and health care remained a favored target.

By 2026, Hive remains the clearest case of what reporting early returned. The benefits of reporting are often invisible at the moment of decision. No victim in late 2022 knew the FBI held Hive’s keys. The hospitals that benefited were those whose plans made the call routine rather than a debate, and who had the people, relationships and rules in place to make it quickly. That preparation costs little, and it pays off whether or not the next call happens to reach investigators who are already holding the keys.