MERIDIANDECISION INTELLIGENCEOwner deskOwnerPublic screen
My judgments
MERIDIAN / EXPLORE

From a question,
to the next decision.

View

Skin

YOUR DECISION WORKSPACEOwner onlyStart a new question Open my judgments →Owner operations desk →
Owner sign-in →Signed in as the ownerSign out — see what a visitor sees →End the Cloudflare Access session too →
Reading language
The screen, the questions and the judgments read in English where an English reading has been made. The Korean originals are unchanged, and evidence stays in the language it was written in.

When to reconnect hospital systems after a ransomware attack

2026NowDeadline · 3 hours until the next surgery and treatment allocation meeting

Realistic synthesis

This is a synthetic scenario for testing. The people, organizations, events, figures, and deadlines are assumptions, and no private records of real individuals were used. The background guidelines do not establish the facts of the case or local legal obligations. Unconfirmed and inferred matters are distinguished, and points requiring jurisdiction, authority, and expert verification are left open.

The question to decide

With the integrity check of the recovery copy still unfinished, should the systems remain isolated, should only verified minimal functions be restored separately, or should connections be widened while monitoring is strengthened?

Who decidesContinuity-of-care lead and incident response and recovery lead

What the AI judgments chose

Reading the judgment record…

AI-generated editorial illustration for the Meridian library.

The options

The order shown is not a ranking of preference.

  1. Option 1

    Maintain full isolation and wait for verification to finish

    Reduces the risk of reconnection but accepts delays in care and errors in paper procedures.

  2. Option 2

    Recover only verified minimal functions in isolation

    Supports some care but increases mismatch between systems and operational complexity.

  3. Option 3

    Expand the scope of connection under intensive monitoring

    Regains processing capacity quickly but residual intrusion and data errors may spread.

The situation as it stands

Core systems have been isolated and care continues on paper procedures, but the risk of duplication and omission is accumulating. The scope of action must be set within three hours, before the next surgery and care assignment meeting.

A fictional general hospital. It contains no intrusion path or method for executing the attack.

  1. Premise 1Core systems have been isolated and care continues on paper procedures, but the risk of duplication and omission is accumulating.
  2. Premise 2The integrity of part of the backups has been confirmed and the rest is still under verification. The risk of re-intrusion has not been ruled out.
  3. Premise 3The transfer capacity of external hospitals is also limited, and the exact headroom is under verification.

Where it holdsDecide the scope of isolation and the order of recovery. A recovery copy whose safety has not been verified cannot be marked as normal.

What is still unknown

  1. Unknown 1Have the integrity of the backups and the actual separation of the isolated environment been confirmed?
  2. Unknown 2Which risk, paper delays or system reconnection, is concentrated on which patients?

Signals to decide again

  • Have the integrity of the backups and the actual separation of the isolated environment been confirmed? If new evidence on this uncertainty arrives, the judgment is made again.
  • Which risk, paper delays or system reconnection, is concentrated on which patients? If new evidence on this uncertainty arrives, the judgment is made again.
Where the paths partNot answers — paths that part from the same starting point
Independent branch 1 · synthetic event

Some record inconsistencies were found in a backup that had been treated as verified. The recovery scope and the clinical cross-checking procedure are being decided again.

Independent branch 2 · synthetic event

The partner hospital offered to take additional patients, but moving critically ill patients carries separate risks. The priority between transfer and limited recovery is being set again.

Material and rootsThe frame, the values and the background documents
symbolic and interpretive frame · The wolf and the shepherd boy

Which signals does a community that has heard repeated warnings stop believing?

An exploratory perspective chosen by the creator. Does not claim supernatural validity or the superiority of any particular option.
Values and norms

The benefits and costs of the options accrue to different stakeholders. Which loss to accept remains undecided.

A subject for the decision-maker to argue over; the materials carry no conclusion of their own.
The record of this question
Question
FSP-TRUST-37 · version 1.17.0
Content identity, SHA-256
d92ffe7e64d199e9148b48746c9da7a7df44ff3136bdb2957c678edba6ced15a
Input files
Question input JSON · What followed, JSON
See it in the record list
RISCON Labsrisconlabs.com