Endocrinology Institute Prague Strengthens Cybersecurity and IT Operations Stability

The Endocrinology Institute Prague is a specialized healthcare facility subordinate to the Ministry of Health of the Czech Republic. It holds a unique position among healthcare providers, combining highly specialized diagnostic and treatment care with research and educational activities.
Endocrinology care specializes in the diagnosis and outpatient treatment of a wide range of endocrine disorders in adults and children, particularly in the fields of thyroidology, diabetology, obesity medicine, osteology, reproduction, and immunology.

The main impetus for selecting a new IT partner was long-standing dissatisfaction with the previous provider. The institute required more reliable and professional management of its entire IT infrastructure, from hardware and software administration through user support to a round-the-clock Service Desk. Aricoma offered comprehensive management of the IT environment with a clearly defined monthly budget and the support of onsite specialists, which the customer accepted.

On November 29, 2023, three days before the planned takeover of services, the institute was hit by a CUBA ransomware attack. The attack encrypted data, blocked servers and workstations, and temporarily interrupted healthcare operations. The primary objective was to restore clinical operations as quickly as possible and subsequently ensure secure long-term operation.

Immediately after the attack, the institute's management asked us to intervene. Within hours, we at Aricoma assembled a joint crisis team, began diagnostics, and prepared a recovery plan. At the same time, we cooperated with NÚKIB on the incident investigation and forensic analysis.

After the investigation was completed, an isolated network was set up on December 4 and the reinstallation of workstations began. The first objective was to restore healthcare operations, which was achieved as early as December 18, within two weeks of the start of the work. This was followed by the installation of the new infrastructure and the restoration of individual services in cooperation with external suppliers.

The key factors behind the speed were fast decision-making, close cooperation with the institute, and experience from previous incidents. Operations were restored, including a complete reinstallation of all systems, and thanks to close cooperation and fast decision-making, the time needed to return to normal operation was significantly shortened. The work included the configuration of server roles, network components, telephony, and access control systems.

After the acute phase was under control, we moved on to managing the ICT environment in a combined model. The institute kept its own IT specialist, who continues to handle selected activities and communicates with users and suppliers. Two Aricoma onsite technicians support him, covering local operations, servicing, and technical support. Aricoma provides central management of workstations, servers, networks, virtualization, and operating systems, with operations managed through a Service Desk in a 10x5 mode. The combination of an internal specialist and onsite technicians significantly shortens the resolution time for incidents and routine requests.

The service includes proactive monitoring and continuous improvement of security, so that the ICT environment remains stable, fast, and ready for further development. As a result, the customer gained unified communication with a single service provider, transparent operations, and professional support. Today, the institute enjoys stable operations, a significantly higher level of cyber protection, and support that responds faster and more predictably than the original supplier, while retaining its own IT employee for internal matters.