From Ransomware Attack to Resilient Infrastructure
Their IT team and their AMC vendor both failed to recover the data. We recovered it in four days — and then got them through NAAC.
Industry: Education & Healthcare (University + Hospital)
Customer Context
A large multi-disciplinary institution — a medical college, nursing college and degree college serving over 6,000 students, alongside a 2,000-bed hospital operating 24×7.
Technology had grown up department by department, and it had broken down the same way. There was no campus network and no data centre. The server room was in poor condition. IT ran as multiple disconnected silos, each department managing its own systems, with no single owner accountable for any of it.
The internal team carried the work but not the mandate. High turnover, combined with academic leadership that had limited technology background, meant no continuity and no strategic direction. Ownership was fragmented across departments, which in practice meant nothing was owned at all.
The symptoms were visible long before the crisis. For years the institution had tried and failed to implement something as basic as biometric attendance.
Business Challenge
Then ransomware took down the Hospital Information Management System and the pharmacy.
A 2,000-bed hospital lost the systems it runs on. Operations were down for three days.
The institution’s own IT team worked on recovery. So did their AMC vendor. Neither could bring the data back.
Why It Mattered
The attack could not have come at a worse moment. A NAAC assessment was approaching, and the institution faced it with a hospital that had been offline for three days, no campus network, no data centre, and a server room that would not survive scrutiny.
For a teaching institution, NAAC accreditation is not a certificate. It governs standing, funding, and the ability to attract students and faculty. Failure would have carried consequences far beyond IT.
That concern reached the top of the institution. The Chancellor, Vice Chancellor, Registrar and Board of Trustees were all directly engaged with the risk.
Danush’s Role
Danush was called in with the hospital already down for three days and two parties having tried and failed to recover it.
Containment first, then rebuild:
- Isolated the affected systems to stop the spread and protect what was still clean
- Rebuilt clean systems rather than attempting to salvage compromised ones
- Built the security layer before anything was brought back online
- Restored the data
Operations were fully recovered in four days.
That recovery is the basis of everything that followed. Nothing in the five years after this was won in a procurement process — it was won in that week.
The institution then asked Danush to audit the entire estate. With NAAC approaching, Danush also advised leadership directly — working with the Chancellor, Vice Chancellor, Registrar and Trustees on accreditation readiness alongside the technical programme.
Solution
Crisis response
- System isolation and containment
- Clean system rebuild
- Security layer implementation
- Full data restoration
Audit and planning
- Comprehensive infrastructure and security audit
- Five-year technology roadmap aligned to institutional growth and compliance requirements
- NAAC accreditation readiness support
Five-year build — delivered and operational
- Campus-wide WiFi
- Campus WAN
- Ground-up data centre
- Disaster recovery centre
- Command and control centre with integrated Video Management System
- Campus surveillance
- Access control and biometric attendance
- Managed services and ongoing help desk
- SOPs and IT policies
- Compliance alignment for NAAC, NABL and NABH
Execution Capability
This engagement demanded three distinct capabilities in sequence, and Danush delivered all three.
Crisis recovery — restoring clinical systems that two other parties could not, under time pressure, in a live 24×7 hospital environment.
Board-level advisory — engaging the Chancellor, Vice Chancellor, Registrar and Trustees on institutional risk, not just technical delivery.
Long-term programme delivery — a five-year build spanning data centre construction, campus networking, surveillance, access control, disaster recovery and managed operations, delivered as one coordinated programme rather than isolated projects.
Business Outcome
- Hospital and pharmacy systems fully restored in four days, after three days down and two prior recovery attempts had failed
- NAAC accreditation achieved — Danush supported compliance preparation and the institution passed within six months
- Biometric attendance implemented and operational — after years of failed internal attempts
- Trusted at board level, advising the Chancellor, Vice Chancellor, Registrar and Trustees on institutional risk
- A professionally owned and managed IT estate, in place of an in-house function with no continuity
- Data centre, DR centre, campus network, command centre and surveillance built and operational
- Disaster recovery capability, directly closing the exposure the attack revealed
- Five years of continuous partnership, and counting
Why This Matters to a Similar Prospect
Most vendors are judged on what they build. This one was judged first on what it could recover — with clinical systems down and two other parties having already tried and failed. Then on whether it could get an institution through an accreditation it was at genuine risk of failing.
If your operations depend on systems nobody clearly owns, the question is not whether the plan looks good on paper. It is who you want in the room on the day it goes down — and whether they can talk to your board as credibly as they can talk to your servers.