Overview
A ransomware attack struck Winnipeg's largest hospital in Manitoba, Ontario this week, breaching not just digital records infrastructure but the facility management systems that control physical building operations. The attack disabled automated door controls and heating, ventilation, and air conditioning equipment — systems whose failure carries immediate safety consequences for patients, staff, and medication or specimen storage conditions.
The incident is among the more visible examples of ransomware crossing from information technology networks into operational technology (OT) — the embedded hardware and software that governs physical building systems. Hospitals have historically treated IT and OT as separate domains, but interconnected networks and aging facility equipment increasingly collapse that distinction.
Security experts cited the attack as evidence that cyberthreat actors are now deliberately targeting the physical infrastructure layer of healthcare facilities, not just clinical or administrative data systems. The ability to disable doors — including those governing secure or sterile areas — and climate control in a clinical environment represents a threat to patient safety that extends well beyond data loss.
Key developments
Facility management systems became the primary attack surface. The ransomware did not appear to target patient records systems as its initial entry point. Instead, the hospital's building management platform — which governs doors, HVAC, and potentially other physical controls — was the system rendered inoperable. This reflects a documented shift in adversary targeting toward OT environments that have weaker security controls than clinical IT systems.
Physical safety consequences distinguished this incident from typical healthcare breaches. Loss of automated door control in a hospital affects infection control zones, pharmacy access, emergency egress, and secure psychiatric or pediatric units. HVAC failure threatens temperature-sensitive medications, laboratory specimens, and patient comfort or safety in surgical or intensive care environments. These are not recoverable through data backups alone.
OT systems in hospitals commonly run outdated or unpatched software. Building management systems are frequently procured and maintained by facilities departments rather than IT or security teams, and they often run legacy operating systems with long patch cycles. This organizational and technical gap creates exploitable conditions that ransomware operators have learned to identify.
The incident illustrates the limits of IT-centric incident response plans. Most hospital ransomware response protocols are designed around protecting or restoring data and clinical applications. An attack that disables physical infrastructure requires coordination with facilities engineering, life safety officers, and potentially local fire and emergency management authorities — stakeholders rarely embedded in standard cyber incident response frameworks.
Industry impact
Ransomware attacks on healthcare organizations have accelerated in frequency and severity. According to the HHS Office for Civil Rights, ransomware incidents affecting healthcare entities have been among the fastest-growing categories of reportable breaches. The IBM Cost of a Data Breach Report has consistently ranked healthcare as the industry with the highest average breach cost — over $10 million per incident in recent reporting cycles — a figure that does not fully account for the operational costs of physical infrastructure outages.
The convergence of IT and OT in healthcare settings has been identified as an emerging risk by the Cybersecurity and Infrastructure Security Agency (CISA) and the HHS 405(d) Health Industry Cybersecurity Practices task group, both of which have published guidance specific to medical device and facility system security. However, uptake of OT-specific controls in hospital environments remains inconsistent, particularly at regional and community hospitals operating with constrained capital budgets.
HIPAA's Security Rule, while focused on electronic protected health information, does not directly regulate OT or facility management systems unless those systems store or transmit PHI. This regulatory gap means hospitals can face catastrophic OT-related disruptions with no specific federal compliance framework driving remediation investment.
## What this means for independent practices
- Audit what your building systems touch. Any practice using networked door access controls, smart HVAC, or integrated facility management platforms should determine whether those systems share network segments with clinical or administrative systems.
- Assign clear ownership for OT security. If facility management is handled separately from IT, confirm that someone with security authority has oversight of building system configurations, vendor access credentials, and patch status.
- Review vendor remote access agreements. Building system vendors frequently retain persistent remote access credentials. Those credentials, if compromised, can provide an entry point that bypasses standard IT perimeter controls.
- Include physical system failures in your contingency plan. HIPAA's Contingency Plan standard (§ 164.312(a)(2)(iv)) requires covered entities to plan for system unavailability. Test whether your plan addresses scenarios where building access or environmental controls are disrupted — not just clinical software.
- Segment OT networks from clinical and administrative systems. Where technically feasible, facility management systems should be isolated from networks that carry PHI or connect to clinical applications.
Independent practices that rely on any networked building infrastructure — even simple keycard door systems or smart thermostats — face a version of this risk at smaller scale. The discipline of knowing what is connected, who has access, and what the failure mode looks like is the same regardless of facility size.
What would have prevented this
Network segmentation between IT and OT environments: Isolating facility management systems on dedicated, firewalled network segments limits an attacker's ability to pivot from a compromised administrative or clinical system into building controls, or vice versa.
Privileged access management for third-party vendors: Building management platforms often carry standing remote access credentials for maintenance vendors. Implementing time-limited, monitored, and least-privilege access for all third parties removes a common initial-access vector.
Asset inventory inclusive of OT and IoT devices: Security teams cannot protect systems they do not know exist. A full asset inventory — covering not just servers and workstations but also building controllers, HVAC management units, and access control systems — is a prerequisite for any meaningful risk assessment.
Patch and vulnerability management extended to facility systems: OT devices are frequently excluded from routine vulnerability scanning and patch cycles. Extending patch management discipline to building management software and firmware, with defined remediation timelines, reduces the exploitable attack surface.
OT-specific incident response planning and tabletop exercises: Response plans that account for physical infrastructure failure — including manual override procedures for doors, escalation paths to facilities engineers, and coordination with local emergency services — enable faster containment and reduce patient safety risk when an attack reaches building systems.