Segmentation limits hospital OT ransomware blast radius in converged networks

At a glance

What this is: This is an analysis of a hospital OT ransomware incident that reached building systems and showed how segmentation determines whether network compromise stays contained or spreads.

Why it matters: It matters because hospitals often connect clinical, facilities, IoT and OT assets on shared networks, and IAM, PAM and NHI teams need to understand how access pathways and segmentation limits affect blast radius.

Context

Hospital operational technology includes the networked systems that keep the building running, such as badge readers, HVAC, elevators and access control. When those systems share a flat network with IT and clinical assets, a compromise in one zone can move into another without encountering meaningful containment.

The article shows a governance gap that security programmes often miss: facilities and building systems are treated as outside the security boundary until they become part of an incident. In healthcare, that boundary matters because resilience depends on whether identity, access and segmentation controls actually separate critical functions.

This is an infrastructure and containment problem first, but it still has an identity angle because access pathways into connected building systems are only as safe as the policy that governs them. The hospital example is typical of converged environments, where operational systems are networked but not consistently controlled as part of the security estate.

Key questions

Q: What breaks when hospital OT systems are left on a flat network?

A: A flat network turns every reachable building system into a potential ransomware target. Once an attacker gets inside, segmentation no longer exists as a boundary and door access, HVAC and elevator systems can be hit alongside IT assets. The practical failure is not just compromise, but uncontrolled blast radius across safety-relevant systems.

Q: Why does segmentation matter more than initial infection prevention in OT incidents?

A: Because initial compromise is often unavoidable, while movement after compromise is what determines business impact. Segmentation limits how far malware can travel from the first foothold, which is especially important in hospitals where building controls, clinical devices and admin systems may otherwise share trust paths.

Q: What do security teams get wrong about NAC in hospital environments?

A: They often assume that deploying NAC means segmentation is already working. In practice, NAC may authenticate devices without proving that real traffic is constrained the way the policy intends. Teams need to validate policy against observed flows or the control remains theoretical.

Q: Who should own segmentation decisions for facilities systems?

A: Ownership should be shared across security, facilities and clinical engineering, because the control is affecting uptime, safety and reachability at the same time. If one group owns the technology in isolation, critical systems can be left outside the decision process and the organisation inherits hidden exposure.

Technical breakdown

Why flat hospital networks let ransomware reach OT systems

In a converged hospital network, operational technology, IoT, IoMT and IT often share routing paths and trust boundaries even when their business functions differ. If attackers gain a foothold anywhere on that plane, they can probe whatever is reachable unless segmentation enforces explicit policy between zones. Ransomware does not need to understand a door controller or an elevator to affect it. It only needs network adjacency and permissive paths. That is why OT incidents often look like ordinary lateral movement until the impact becomes physical. The control failure is not encryption or malware alone. It is unconstrained reachability across systems with very different safety roles.

Practical implication: map where clinical, facilities and building-control traffic still shares the same trust zone, then isolate those paths before the next intrusion tests them.

Why NAC alone does not equal segmentation

Network access control can authenticate a device or restrict who joins a network, but that does not automatically enforce fine-grained separation between systems once traffic is flowing. Many organisations deploy NAC and then assume segmentation exists, when in practice policy may never be operationalised against real device relationships. Effective segmentation needs device context, rule design and validation against observed traffic, otherwise a policy can be technically present but functionally irrelevant. In hospitals, the hardest part is not the concept of zoning. It is proving that the enforced paths match the actual dependencies of facilities systems, nurse-call systems and clinical services without interrupting uptime.

Practical implication: validate NAC policy against real network flows before enforcement, or the control will remain administrative rather than protective.

Why continuous policy alignment matters in OT and IoT environments

OT and building systems drift faster than many security teams expect because devices are replaced, firmware changes, ports move and network assignments shift. A segmentation design that was correct at deployment can become stale without anyone noticing. That creates a hidden exposure window in which newly added or repurposed devices inherit old trust relationships. Continuous segmentation closes that gap by comparing live reality with the policy intent and flagging drift before it becomes reachability. For healthcare, that matters because an inaccurate map is not just a visibility issue. It is a containment failure waiting for an incident to expose it.

Practical implication: treat segmentation as an ongoing control with drift monitoring, not a one-time network redesign.

Threat narrative

Attacker objective: The attacker’s objective was to disrupt hospital operations by encrypting or disabling building systems that the network allowed the ransomware to reach.

1. Entry occurred through an as-yet-unconfirmed path into the hospital network, where the attacker could reach more than one operational zone once inside.
2. Escalation came from unrestricted lateral movement across shared network paths, allowing ransomware to move from the initial foothold into facility maintenance systems.
3. Impact landed on door access, HVAC and elevators, creating operational disruption while clinical services reportedly continued uninterrupted.

Breaches seen in the wild

• Verkada camera breach 2021: Admin credentials on Verkada's exposed Jenkins support server let hackers into a support interface and customer cameras at 97 customers.
• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Blast-radius control is the real OT security question: in converged hospitals, the important failure is not whether ransomware can enter, but how far it can travel. Segmentation becomes the decisive governance control because physical systems are reachable only when policy allows them to be. Practitioners should treat reachability as a business-risk variable, not just a network design choice.

Facilities systems belong inside the security boundary: badge readers, HVAC and elevators are not peripheral assets once they are networked. If they are outside the governance model, the organisation has outsourced containment to architecture luck. The article reinforces a broader identity and access lesson: asset scope defines control scope, and anything on the network needs an accountable policy owner.

Policy simulation is the missing confidence layer: many hospitals hesitate to enforce segmentation because they fear service interruption, and that fear is rational. The governance gap is not intent, it is the inability to prove impact before enforcement. Simulating policy against observed traffic turns segmentation from a risky change into a controlled decision, which is how containment becomes operationally survivable.

Continuous segmentation is now part of operational resilience: static network maps age quickly in OT and IoT environments, so a control that worked last quarter may already be obsolete. That creates a drift problem, not a design problem, and drift is where attackers find reachability. Practitioners should think of segmentation as a living control aligned to current device and flow reality.

Networked building systems create a convergence debt that most security programmes still carry: the more a hospital blends IT, OT and IoT into shared infrastructure, the more every access decision has to account for safety impact. The lesson is not just to segment harder. It is to govern shared trust zones as a distinct operational risk class, with clear accountability for containment.

What this signals

Segmentation is now a resilience control, not just a network hygiene task: in healthcare, the question is whether an intrusion can be contained before it reaches systems that affect building safety. That changes how teams prioritise network redesign, because containment value now extends beyond data loss into operational continuity.

Convergence debt is the hidden problem in hospital environments: the more facilities, OT and IT share infrastructure, the more every access path becomes a governance issue. Security teams should expect these environments to surface policy drift, unmanaged devices and boundary confusion unless they continuously reconcile inventory with enforcement.

Blast-radius management will matter more than perimeter assumptions: attackers do not need full control of a hospital to create material disruption, only enough reach to touch the wrong systems. Practitioners should measure how quickly a compromise can cross zones, then reduce that reach with enforced segmentation and monitored drift.

For practitioners

• Inventory every connected building and OT device Create an authoritative, agentless inventory of badge readers, HVAC controllers, elevators, nurse-call dependencies and other unmanaged devices so they can be placed into enforceable zones.
• Validate segmentation with live traffic before enforcement Simulate proposed NAC-native rules against observed flows to identify which clinical, facilities and maintenance connections would break before policy is applied.
• Separate facilities systems from clinical and IT trust zones Define explicit segmentation boundaries for operational technology so a compromise in one zone does not automatically permit movement into another.
• Monitor policy drift continuously Reassess segmentation as devices move, firmware changes and networks evolve, because yesterday’s correct policy can become today’s exposure window.
• Assign governance ownership for OT containment Make facilities, clinical engineering and security jointly accountable for reachability decisions so safety systems are not left outside the control model.

Key takeaways

• Hospital ransomware incidents can become OT incidents when building systems live on the same network as clinical and IT assets.
• The critical failure is not only compromise, but how much physical and operational reach the attacker gains after entry.
• Segmentation, validated against live traffic and maintained continuously, is the control that shrinks blast radius in converged environments.

Key terms

• Operational Technology: Operational Technology is the hardware and software that monitors or controls physical processes such as manufacturing lines, utilities, and transportation systems. Unlike standard IT, OT prioritises uptime and safety, so identity controls must be precise enough to reduce risk without interrupting essential operations.
• Segmentation: The practice of dividing an audience into groups so that messages, offers or experiences can be tailored. In identity terms, segmentation depends on reliable attributes, and it fails quickly when the source data is stale, duplicated or poorly governed.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Network access control: Network access control is the policy layer that decides which devices are allowed to connect to a network. It is related to device access control, but it governs entry to the network path rather than the use of specific local hardware or peripherals once connected.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity and secrets management. It helps practitioners connect identity controls to the broader security decisions that shape real-world containment.