Wiper Malware Incident Response Guide for Hospital Pneumatic Tube Control Systems

A suspected wiper malware incident affecting a hospital pneumatic tube system can threaten both network integrity and time-sensitive clinical workflows. Treat the system as operational technology: coordinate cybersecurity response with clinical, facilities, biomedical engineering, and vendor teams, and make patient safety the priority.

This guide provides general response considerations, not equipment-specific operating instructions. Follow your hospital’s incident response and downtime plans, manufacturer guidance, and established safety procedures.

How can hospitals confirm suspected wiper malware activity?

Look for unusual signs such as control servers or workstations becoming unavailable, unexpected deletion or corruption of files, unexplained restarts, loss of communication with pneumatic tube control panels, abnormal station status, or security alerts. These signs warrant investigation but do not, by themselves, confirm a wiper infection.

Have authorized incident responders compare endpoint and network alerts, authentication records, system logs, backup status, and recent changes against known-good configurations. Coordinate with the system manufacturer before running tools, commands, or diagnostics on control equipment; actions that are routine on office computers can affect specialized control systems. NIST’s Guide to Operational Technology Security emphasizes that OT response must account for reliability and safety requirements.

Preserve relevant logs, alerts, and system details. When it is safe and feasible, qualified responders should consider volatile memory preservation before shutting down affected computers, since power loss can destroy forensic evidence. Do not delay urgent containment when ongoing activity threatens patient safety or could spread to other systems: use the incident team’s preplanned decision process to balance evidence preservation, containment, and service availability. CISA discusses this evidence and containment tradeoff in its ICS incident response guidance.

What should the incident response team document and communicate?

Maintain a time-stamped incident record that captures observed symptoms, affected devices and locations, alerts and logs collected, changes made, containment steps, service interruptions, and the people who approved consequential actions. Record which system functions are known to work, which are uncertain, and which have been taken out of service.

Use out-of-band incident communications—such as approved phones or radios—if the integrity of email, messaging, or other network services is uncertain. Tell staff which channels to use, who can issue operational instructions, how often updates will be provided, and how to report urgent changes. Avoid sharing sensitive patient information over unapproved channels.

Coordinate updates among the incident commander, cybersecurity and IT teams, clinical leadership, pharmacy, laboratory, blood bank, facilities, biomedical engineering, the system manufacturer, and executive or privacy personnel as appropriate. HHS’s Hospital Downtime Operations Checklist recommends planning alternate communications, assigning staff to delivery and coordination tasks, and documenting activities during downtime.

How should affected pneumatic tube control systems be contained?

Do not automatically shut down the entire pneumatic tube system—or leave a suspected compromised system operating—without assessing patient-safety and security risks. The incident commander should coordinate with clinical operations, facilities, cybersecurity responders, and the manufacturer to choose the safest available containment action.

Where feasible, responders can use network-level measures to isolate confirmed or suspected affected components while preserving other hospital services. Options may include carefully applied firewall access controls, restricting unnecessary remote connections, and isolating the affected control network. Verify that each change does not interfere with essential safety functions or unrelated clinical systems. CISA’s ICS incident response guidance recommends planning and testing network disconnection methods so containment does not unnecessarily disrupt critical operations.

Consider wireless interface isolation and disable other connectivity only through an authorized, system-specific response plan. If equipment must be stopped or powered down to prevent further harm, use the manufacturer’s instructions and hospital safety procedures. Keep a record of what was isolated, when, by whom, and how the team confirmed the containment action.

How can hospitals maintain critical-item delivery during downtime?

Activate healthcare downtime procedures and delivery continuity protocols as soon as authorized leadership determines the pneumatic tube system is unavailable or cannot be trusted. Assign a coordinator to prioritize requests, identify approved routes, and track each item from sender to recipient.

Use trained staff runners or other hospital-approved transport methods for urgent medications, blood products, specimens, and critical messages. Follow the organization’s procedures for packaging, temperature control, identity checks, chain of custody, and handoff documentation; requirements differ by item and clinical workflow. If system routing or carrier status is uncertain, do not send clinical items through the affected system until it has been cleared for use.

Use approved downtime forms or logs to record the item, priority, origin, destination, dispatch and receipt times, and responsible staff. Reconcile these records with clinical and laboratory systems when service is restored. The HHS-supported hospital downtime checklist describes using runners to coordinate and deliver orders, laboratory work, bloodwork, and critical values during a cyber incident.

What cybersecurity risks affect network-connected pneumatic tube systems?

Network-connected pneumatic tube systems may include control servers, workstations, pneumatic tube control panels, station interfaces, network connections, and vendor-supported maintenance access. Each connected component or access path can introduce cybersecurity risk if it is poorly protected, misconfigured, or reached through compromised credentials. Confirm the actual architecture with the hospital’s system documentation and manufacturer.

Potential risks include unauthorized remote access, unpatched or unsupported software, weak or shared credentials, excessive network access, removable media, and wireless connections that are not adequately secured. A compromise could affect system availability, control visibility, or the reliability of routing information. Do not assume a particular component is vulnerable or affected without evidence.

NIST describes OT as technology that monitors or controls physical processes and notes that its security measures must account for safety, reliability, and performance. Hospitals should use those principles to review segmentation, vendor access, firewall access controls, authentication, wireless interface isolation, backups, and monitoring for their specific system—not to apply changes to production equipment without appropriate testing and approval. See NIST’s Guide to Operational Technology Security.

How should hospitals restore and verify system operation?

Restore service only after the incident team has contained the threat, addressed the suspected entry path, and approved recovery. Work with qualified system specialists and the manufacturer to assess affected equipment, rebuild or recover systems as appropriate, and verify that backups and configuration files are trustworthy before using them. NIST’s OT security guidance and its OT Backup Quick Start Guide emphasize recovery planning, backup management, and testing.

Before resuming clinical use, conduct controlled checks under approved procedures. Verify station status, intended routing, alarms, communications, and other manufacturer-specified functions. Use test carriers or other nonclinical checks where the manufacturer and hospital procedures permit; do not use medications, blood products, or specimens as test items. Document test results, unresolved limitations, approvals, and the time service is cleared for use.

Resume service in a controlled manner, inform affected departments, and monitor for renewed alerts or unexpected behavior. Keep downtime delivery records until teams have reconciled them with clinical and operational records. In short, confirm the incident, contain it without compromising safety, maintain manual delivery workflows, and return the system to service only after documented verification.

FAQs

Should hospital pneumatic tube control systems be shut down during suspected wiper activity?

Not automatically. The response team should weigh patient safety, the risk of further damage or spread, evidence preservation, and the system’s current condition. Isolate affected components where feasible, and shut down equipment only when the incident commander and appropriate technical and clinical leads determine that it is necessary and safe under hospital and manufacturer procedures.

How can hospitals transport urgent medications and blood products while the system is unavailable?

Use the hospital’s approved downtime transport process, such as trained staff runners, with item-specific packaging, handling, temperature, identity, and handoff checks. Record dispatch and receipt details, and follow pharmacy, transfusion, and clinical policies. Do not send urgent items through a system whose routing or operational integrity has not been verified.

How should hospitals verify pneumatic tube system operation after repairs?

Have qualified personnel and the manufacturer follow the approved validation procedure. Check station and control status, routing, communications, alarms, and other required functions using permitted controlled tests before clinical use. Document results and authorization to resume service, then monitor the system and reconcile downtime records.

What should staff do if attackers may still have access to the control network?

Report the concern through the designated incident channel, use approved out-of-band communications if network services may be compromised, and follow instructions from the incident commander. Do not reconnect equipment, change settings, or attempt ad hoc repairs. The response team should investigate and close unauthorized access paths before approving recovery or reconnection.