Cyber resilience in public health: a narrative case study of the Aurum Institute ransomware attack

Aim Ransomware has become a decisive risk for public health organisations, halting programme delivery, compromising sensitive data, and eroding trust. This case study shares the experiences of a South African non-profit organisation, the Aurum Institute, which was the victim of a ransomware attack in February 2024. The case study details the incident and response, and discusses lessons learnt in terms of preparedness, containment, and recovery. Method Adopting a descriptive case study approach, this paper provides a detailed narrative to reconstruct the ransomware attack on the Aurum Institute, describing the context in which the incident occurred, what happened during the attack, and the impacts that followed. The analysis is constructed around the themes of preparedness, containment, and subsequent operational recovery. Findings Aurum’s resilience depended not on any single control, but on a combination of implementing a dynamic business recovery plan, cloud segregation of core services, disciplined leadership, external forensic support, and recoverable backups. These strengths enabled the organisation to preserve critical business functions and prepare for structured restoration, while the incident also exposed important weaknesses in monitoring, credential governance, vendor oversight, and data inventories. The case demonstrates that recoverable backups, segmented cloud-based services, disciplined crisis leadership, and specialist forensic support were central to restoring continuity after the attack. Conclusion Cybersecurity is now inseparable from public health mission continuity. As such, health NPOs should treat cybersecurity as enterprise governance, prioritise investments according to risk and affordability, strengthen identity and detection capabilities, improve segmentation and recoverability, and engage donors, stakeholders, and insurers in more realistic conversations about the costs and trade-offs of resilience.