Executive Snapshot

• Client Type: Medical Billing 
• Footprint: 200+ locations  Headquaters, data centers, servers and workstations 
• Post incident: 10+ class action lawsuits filed 
• The Challenge: Mitigating a large-scale attack while remaining operational and reducing loss of PII and EMR 
• The Outcome: Fortified defenses as part of defense in depth leads to successful attack mitigation and recovery of customer data 
• Solution Areas: eSentire, workstation provisioning, firewalls with network access controls, data backups, web filtering, secure web gateways, application whitelisting, dark web intel, brand surveillance, consulting, project management 

The Challenge 

One medical billing company found itself faced with one of the industry’s worst nightmares, a large-scale ransom attack. Beyond the operational blockages this immediately posed, including outages of more than 2,000 endpoints, the company was also trying to limit the loss of company data, prevent further breach of information, and avoid damage to their brand reputation. Leadership quickly realized they would need expert help to quickly and efficiently manage the situation.  

The Solution 

Faced with a growing cybersecurity crisis, the team sought experienced support. The company’s CISO had an existing relationship with Steve Ihnatiuk, Account Executive at Paragon Micro, who quickly brought in Steve Baer, Director of Cybersecurity and Networking and a cybersecurity professional with more than 20 years of experience. 

Paragon Micro immediately began working alongside the company’s IT team, taking a multi-layered approach to contain the breach, limit further data loss, and strengthen the organization’s defenses. 

“We met a client on the worst day they’d ever had. That’s not an ideal situation in any event. While they were triaging in the background, we provided practical advice on what would happen should they choose to pay or fight the ransom attack. We were able to provide immediate value and calm the worst of their fears on day one. Then we jumped in to tackle the problem,” says Baer. 

The first priority was gaining greater visibility and control across the environment. Paragon Micro brought in eSentire and network access control capabilities to help the team identify and manage devices across the network, establish containment boundaries, and limit further data loss. 

From there, Baer’s team began segmenting the network to strengthen access controls and reduce the attack surface. At the same time, the company was navigating requirements from its cyber insurance provider. When another recommended cybersecurity solution proved cost prohibitive for the small IT team, Baer identified eSentire as a more practical option that could provide the protection the organization needed while aligning with its budget. 

With the immediate threat contained, the focus shifted to reducing the risk of another attack. Paragon Micro helped deploy additional security technologies and address vulnerabilities that could leave the organization exposed again. 

Baer notes that organizations that have experienced a breach can remain particularly vulnerable if the conditions that enabled the initial attack are not addressed. For this company, strengthening those underlying defenses became just as important as responding to the immediate incident. 

Even 45 days after the attack, the company was still recovering while working to reduce future risk. Throughout that process, Paragon Micro maintained consistent communication and provided guidance beyond individual security technologies, helping the team evaluate its cybersecurity defenses, business practices, and internal processes. 

“Ultimately, our goal was to solve the problem and put the right technology and services in front of them to make an impact. There is no purpose-built technology to address their issues, so we had to construct that from the ground up,” says Baer. 

The Results  

• Implemented breach mitigation tools and strategies to recover 2,000 endpoints 
• Limited loss of PII originating from 200+ locations 
• Standardized cybersecurity practices, including logging, consistent monitoring, path management, network segmentation, data backups, and email security 
• Organization-wide threat monitoring deployment  

Mitigating the Problem 

Paragon Micro supplied immediate support and provided clear actionable steps for managing the ransom attack, while also consulting on modernization of business practices and lessening the threat surface across the organization.  

Implementing Safeguards 

Once the initial attack was contained, Paragon Micro implemented organization-wide safeguards to prevent ongoing attacks. Recognizing the potential for repeated incidents, Baer personally oversaw their customized, multi-layer security plan. 

The Execution 

Paragon Micro oversaw every element of technology selection and maintained consistent communications with daily status calls and ad-hoc meetings until the incident was contained. To maintain a secure position moving forward, the team oversaw backup restoration and aligned business practices to lessen risks. 

Customer Impact 

The customer was able to resume operations within a day of Paragon Micro’s involvement, resuming endpoint functionality for more than 2,000 users. Additionally, they have gained confidence in their security posture and recovered brand credibility by maintaining quick and efficient responses. They can now ensure customer data remains secure. 

Why It Matters 

Protecting customer data is paramount in a digital-forward business landscape. According to data from a 2024 Cisco survey, more than 75% of consumers will not buy from an organization they don’t trust with their data.  Loss of data posed an immediate issue, but the added diminishing of brand trust was the highest stake. Now, they have what matters. Enhanced protections. Better business practices. Consumer trust.