{"id":"https://openalex.org/W7223649259","doi":"https://doi.org/10.61473/001c.170686","title":"Cyber resilience in public health: a narrative case study of the Aurum Institute ransomware attack","display_name":"Cyber resilience in public health: a narrative case study of the Aurum Institute ransomware attack","publication_year":2026,"publication_date":"2026-10-26","ids":{"openalex":"https://openalex.org/W7223649259","doi":"https://doi.org/10.61473/001c.170686"},"language":"en","primary_location":{"id":"doi:10.61473/001c.170686","doi":"https://doi.org/10.61473/001c.170686","is_oa":true,"landing_page_url":"https://doi.org/10.61473/001c.170686","pdf_url":"https://sahr.hst.org.za/article/170686.pdf","source":{"id":"https://openalex.org/S2764593513","display_name":"South African Health Review","issn_l":"1025-1715","issn":["1025-1715","1608-0343"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":["dhet"],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by-nc","license_id":"https://openalex.org/licenses/cc-by-nc","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"South African Health Review","raw_type":"journal-article"},"volume":null,"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://sahr.hst.org.za/article/170686.pdf","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5053433338","display_name":"Jacqueline Paterson","orcid":"https://orcid.org/0000-0001-5225-8693","observed_orcids":["https://orcid.org/0000-0001-5225-8693"]},"institutions":[{"id":"https://openalex.org/I4210119199","display_name":"Aurum Institute","ror":"https://ror.org/01tcy5w98","country_code":"ZA","type":"nonprofit","lineage":["https://openalex.org/I4210119199"]}],"countries":["ZA"],"is_corresponding":false,"raw_author_name":"Jacqueline Paterson","raw_affiliation_strings":["Aurum Institute"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Aurum Institute","institution_ids":["https://openalex.org/I4210119199"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5159720468","display_name":"Cristian Pieterse","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4210119199","display_name":"Aurum Institute","ror":"https://ror.org/01tcy5w98","country_code":"ZA","type":"nonprofit","lineage":["https://openalex.org/I4210119199"]}],"countries":["ZA"],"is_corresponding":false,"raw_author_name":"Cristian Pieterse","raw_affiliation_strings":["Aurum Institute"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Aurum Institute","institution_ids":["https://openalex.org/I4210119199"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5159654247","display_name":"Khangwelo Mulaudzi","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4210119199","display_name":"Aurum Institute","ror":"https://ror.org/01tcy5w98","country_code":"ZA","type":"nonprofit","lineage":["https://openalex.org/I4210119199"]}],"countries":["ZA"],"is_corresponding":false,"raw_author_name":"Khangwelo Mulaudzi","raw_affiliation_strings":["Aurum Institute"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Aurum Institute","institution_ids":["https://openalex.org/I4210119199"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5159667774","display_name":"David A Clark","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4210119199","display_name":"Aurum Institute","ror":"https://ror.org/01tcy5w98","country_code":"ZA","type":"nonprofit","lineage":["https://openalex.org/I4210119199"]},{"id":"https://openalex.org/I901861585","display_name":"Vanderbilt University Medical Center","ror":"https://ror.org/05dq2gs74","country_code":"US","type":"healthcare","lineage":["https://openalex.org/I4210162197","https://openalex.org/I901861585"]}],"countries":["US","ZA"],"is_corresponding":false,"raw_author_name":"David A Clark","raw_affiliation_strings":["Aurum Institute","Vanderbilt University Medical Center"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Aurum Institute","institution_ids":["https://openalex.org/I4210119199"]},{"raw_affiliation_string":"Vanderbilt University Medical Center","institution_ids":["https://openalex.org/I901861585"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.86994344,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"28","issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9535999894142151,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9535999894142151,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T14029","display_name":"Thoreau and American Literature","score":0.02239999920129776,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12221","display_name":"Cybersecurity and Cyber Warfare Studies","score":0.006000000052154064,"subfield":{"id":"https://openalex.org/subfields/3320","display_name":"Political Science and International Relations"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ransomware","display_name":"ransomware","score":0.8939999938011169},{"id":"https://openalex.org/keywords/cyber-resilience","display_name":"cyber resilience","score":0.9750000238418579},{"id":"https://openalex.org/keywords/public-health-organisations","display_name":"public health organisations","score":0.8080000281333923},{"id":"https://openalex.org/keywords/nonprofit-organizations","display_name":"nonprofit organizations","score":0.7570000290870667},{"id":"https://openalex.org/keywords/incident-response","display_name":"incident response","score":0.781000018119812},{"id":"https://openalex.org/keywords/business-continuity-planning","display_name":"business continuity planning","score":0.847000002861023},{"id":"https://openalex.org/keywords/cloud-segmentation","display_name":"cloud segmentation","score":0.8379999995231628},{"id":"https://openalex.org/keywords/data-backup","display_name":"data backup","score":0.703000009059906},{"id":"https://openalex.org/keywords/forensic-investigation","display_name":"forensic investigation","score":0.6690000295639038},{"id":"https://openalex.org/keywords/data-inventory","display_name":"data inventory","score":0.6320000290870667},{"id":"https://openalex.org/keywords/cybersecurity-governance","display_name":"cybersecurity governance","score":0.6589999794960022},{"id":"https://openalex.org/keywords/crisis-leadership","display_name":"crisis leadership","score":0.4650000035762787}],"concepts":[{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.7603999972343445},{"id":"https://openalex.org/C2779585090","wikidata":"https://www.wikidata.org/wiki/Q3457762","display_name":"Resilience (materials science)","level":2,"score":0.6317999958992004},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.6079999804496765},{"id":"https://openalex.org/C199033989","wikidata":"https://www.wikidata.org/wiki/Q1318295","display_name":"Narrative","level":2,"score":0.5537999868392944},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4787999987602234},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.4154999852180481},{"id":"https://openalex.org/C39549134","wikidata":"https://www.wikidata.org/wiki/Q133080","display_name":"Public relations","level":1,"score":0.40720000863075256},{"id":"https://openalex.org/C137176749","wikidata":"https://www.wikidata.org/wiki/Q4105337","display_name":"Psychological resilience","level":2,"score":0.39570000767707825},{"id":"https://openalex.org/C2778143579","wikidata":"https://www.wikidata.org/wiki/Q831801","display_name":"Business continuity","level":2,"score":0.3903000056743622},{"id":"https://openalex.org/C129230348","wikidata":"https://www.wikidata.org/wiki/Q1140205","display_name":"Disaster recovery","level":2,"score":0.38589999079704285},{"id":"https://openalex.org/C74196892","wikidata":"https://www.wikidata.org/wiki/Q7781188","display_name":"Thematic analysis","level":3,"score":0.3808000087738037},{"id":"https://openalex.org/C2777338717","wikidata":"https://www.wikidata.org/wiki/Q1762621","display_name":"Vendor","level":2,"score":0.34630000591278076},{"id":"https://openalex.org/C522325796","wikidata":"https://www.wikidata.org/wiki/Q471880","display_name":"Identity theft","level":2,"score":0.34549999237060547},{"id":"https://openalex.org/C138816342","wikidata":"https://www.wikidata.org/wiki/Q189603","display_name":"Public health","level":2,"score":0.33500000834465027},{"id":"https://openalex.org/C2778355321","wikidata":"https://www.wikidata.org/wiki/Q17079427","display_name":"Identity (music)","level":2,"score":0.3264000117778778},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.32339999079704285},{"id":"https://openalex.org/C29852176","wikidata":"https://www.wikidata.org/wiki/Q373338","display_name":"Critical infrastructure","level":2,"score":0.3165999948978424},{"id":"https://openalex.org/C2780851881","wikidata":"https://www.wikidata.org/wiki/Q1141276","display_name":"Crisis management","level":2,"score":0.30329999327659607},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.29899999499320984},{"id":"https://openalex.org/C2776361769","wikidata":"https://www.wikidata.org/wiki/Q821775","display_name":"Public health surveillance","level":3,"score":0.2955000102519989},{"id":"https://openalex.org/C165609540","wikidata":"https://www.wikidata.org/wiki/Q1172486","display_name":"Data breach","level":2,"score":0.28700000047683716},{"id":"https://openalex.org/C201307755","wikidata":"https://www.wikidata.org/wiki/Q4071928","display_name":"Cyber-attack","level":2,"score":0.2775999903678894},{"id":"https://openalex.org/C106399304","wikidata":"https://www.wikidata.org/wiki/Q868123","display_name":"Snowball sampling","level":2,"score":0.2712000012397766},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.26750001311302185},{"id":"https://openalex.org/C117893075","wikidata":"https://www.wikidata.org/wiki/Q6966213","display_name":"Narrative inquiry","level":3,"score":0.25369998812675476},{"id":"https://openalex.org/C190248442","wikidata":"https://www.wikidata.org/wiki/Q839486","display_name":"Qualitative research","level":2,"score":0.25200000405311584}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.61473/001c.170686","doi":"https://doi.org/10.61473/001c.170686","is_oa":true,"landing_page_url":"https://doi.org/10.61473/001c.170686","pdf_url":"https://sahr.hst.org.za/article/170686.pdf","source":{"id":"https://openalex.org/S2764593513","display_name":"South African Health Review","issn_l":"1025-1715","issn":["1025-1715","1608-0343"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":["dhet"],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by-nc","license_id":"https://openalex.org/licenses/cc-by-nc","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"South African Health Review","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.61473/001c.170686","doi":"https://doi.org/10.61473/001c.170686","is_oa":true,"landing_page_url":"https://doi.org/10.61473/001c.170686","pdf_url":"https://sahr.hst.org.za/article/170686.pdf","source":{"id":"https://openalex.org/S2764593513","display_name":"South African Health Review","issn_l":"1025-1715","issn":["1025-1715","1608-0343"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":["dhet"],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by-nc","license_id":"https://openalex.org/licenses/cc-by-nc","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"South African Health Review","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.6601999998092651,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, justice, and strong institutions"},{"score":0.6240000128746033,"id":"https://metadata.un.org/sdg/3","display_name":"Good health and well-being"}],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7223649259.pdf","grobid_xml":"https://content.openalex.org/works/W7223649259.grobid-xml"},"referenced_works_count":14,"referenced_works":["https://openalex.org/W2523880444","https://openalex.org/W2901779959","https://openalex.org/W4375858893","https://openalex.org/W4380730871","https://openalex.org/W4386216064","https://openalex.org/W4391166896","https://openalex.org/W4394683203","https://openalex.org/W4403064601","https://openalex.org/W4410362603","https://openalex.org/W4411466943","https://openalex.org/W4414776504","https://openalex.org/W7077049281","https://openalex.org/W7105799032","https://openalex.org/W7126103605"],"related_works":["https://openalex.org/W7171049309","https://openalex.org/W4402098686","https://openalex.org/W7218033008","https://openalex.org/W7115953684","https://openalex.org/W7214082112","https://openalex.org/W4405062622","https://openalex.org/W3216141743","https://openalex.org/W7165135764","https://openalex.org/W7162772135","https://openalex.org/W3165013081"],"abstract_inverted_index":{"Aim":[0],"Ransomware":[1],"has":[2],"become":[3],"a":[4,27,40,67,75,130,134],"decisive":[5],"risk":[6,231],"for":[7,164],"public":[8,213],"health":[9,214,219],"organisations,":[10],"halting":[11],"programme":[12],"delivery,":[13],"compromising":[14],"sensitive":[15],"data,":[16],"and":[17,52,54,63,100,115,149,162,180,195,232,236,241,243,247,256],"eroding":[18],"trust.":[19],"This":[20],"case":[21,47,69,184],"study":[22,48,70],"shares":[23],"the":[24,32,37,50,80,84,88,92,98,101,110,155,168,205,254],"experiences":[25],"of":[26,39,60,112,132,141,258],"South":[28],"African":[29],"non-profit":[30],"organisation,":[31],"Aurum":[33,85],"Institute,":[34,86],"which":[35,91],"was":[36],"victim":[38],"ransomware":[41,81],"attack":[42,82],"in":[43,58,90,174,249],"February":[44],"2024.":[45],"The":[46,105,183],"details":[49],"incident":[51,93,169],"response,":[53],"discusses":[55],"lessons":[56],"learnt":[57],"terms":[59],"preparedness,":[61,113],"containment,":[62,114],"recovery.":[64,118],"Method":[65],"Adopting":[66],"descriptive":[68],"approach,":[71],"this":[72],"paper":[73],"provides":[74],"detailed":[76],"narrative":[77],"to":[78,157,201,230],"reconstruct":[79],"on":[83,124,129],"describing":[87],"context":[89],"occurred,":[94],"what":[95],"happened":[96],"during":[97],"attack,":[99],"impacts":[102],"that":[103,186],"followed.":[104],"analysis":[106],"is":[107,209],"constructed":[108],"around":[109],"themes":[111],"subsequent":[116],"operational":[117],"Findings":[119],"Aurum\u2019s":[120],"resilience":[121],"depended":[122],"not":[123],"any":[125],"single":[126],"control,":[127],"but":[128],"combination":[131],"implementing":[133],"dynamic":[135],"business":[136,160],"recovery":[137],"plan,":[138],"cloud":[139],"segregation":[140],"core":[142],"services,":[143,191],"disciplined":[144,192],"leadership,":[145,194],"external":[146],"forensic":[147,197],"support,":[148],"recoverable":[150,187],"backups.":[151],"These":[152],"strengths":[153],"enabled":[154],"organisation":[156],"preserve":[158],"critical":[159],"functions":[161],"prepare":[163],"structured":[165],"restoration,":[166],"while":[167],"also":[170],"exposed":[171],"important":[172],"weaknesses":[173],"monitoring,":[175],"credential":[176],"governance,":[177,226],"vendor":[178],"oversight,":[179],"data":[181],"inventories.":[182],"demonstrates":[185],"backups,":[188],"segmented":[189],"cloud-based":[190],"crisis":[193],"specialist":[196],"support":[198],"were":[199],"central":[200],"restoring":[202],"continuity":[203],"after":[204],"attack.":[206],"Conclusion":[207],"Cybersecurity":[208],"now":[210],"inseparable":[211],"from":[212],"mission":[215],"continuity.":[216],"As":[217],"such,":[218],"NPOs":[220],"should":[221],"treat":[222],"cybersecurity":[223],"as":[224],"enterprise":[225],"prioritise":[227],"investments":[228],"according":[229],"affordability,":[233],"strengthen":[234],"identity":[235],"detection":[237],"capabilities,":[238],"improve":[239],"segmentation":[240],"recoverability,":[242],"engage":[244],"donors,":[245],"stakeholders,":[246],"insurers":[248],"more":[250],"realistic":[251],"conversations":[252],"about":[253],"costs":[255],"trade-offs":[257],"resilience.":[259]},"counts_by_year":[],"updated_date":"2026-11-04T10:54:05.112534","created_date":"2026-10-27T00:00:00"}