Historical intelligence backfill. This assessment covers reporting originally published on 2026-08-12 and was added to the RWP archive on 2026-09-07.
Winnipeg HSC ransomware hit HVAC and doors — clinical networks held
Shared Health, 10 August 2026 — facility maintenance, including HVAC and door access, at Health Sciences Centre. Patient care continued. No public actor, no public initial access. BMS is the story, not EHR.
Bottom line up front
CONFIRMED 10 August 2026 Shared Health disclosed a ransomware incident at Winnipeg Health Sciences Centre affecting facility maintenance systems, including HVAC and door access controls. Clinical operations continued. Province notified; third-party IR engaged. No public claim of responsibility; initial access not published. Nozomi 12 August: this is BMS/OT, not EHR or billing — hospital air is infection control (ASHRAE 170), not comfort. Segmentation between clinical and facility networks appears to have held (ASSESSED from the "care uninterrupted" outcome, not from a network diagram RWP has seen). Actor: UNKNOWN. PLC/process malware: not claimed. BACnet-era BMS exposure is the class lesson, not a new ICS worm.
Historical backfill of 12 August 2026 reporting; added 7 September 2026.
What happened
Ransomware on the building, not the EMR. Air handlers and doors were in the blast radius. Surgery did not stop.
Why it mattered
A hospital that can still chart but cannot guarantee isolation-room pressure has not "dodged" OT impact. It has been lucky on the clinical VLAN.
Who / what was affected
HSC facility systems. Patients: no care interruption reported. Infant wards/pharmacies/doors: in the threat model even if not named as failed.
Technical context
Inventory BMS. Segment facilities from clinical and from IT. Monitor BACnet. Vendor remote access to chillers is an identity problem.
Exploitation / threat status at the time
CONFIRMED ransomware on facility maintenance as the operator stated.
UNKNOWN strain, access vector, whether HVAC setpoints actually changed vs workstations encrypted.
What defenders should have done
- BMS asset inventory that is not a spreadsheet.
- Prove segmentation, do not assume it.
- Manual HVAC/door fallback drills.
RWP assessment
Confidence: High on the disclosure. Medium on "HVAC turned off" as physical effect — operator said systems were affected, not that rooms went unsafe.
Defensive actions
- Treat hospital BMS as clinical-adjacent OT.
- Log engineering downloads to HVAC controllers.
- Do not file this under "healthcare IT ransomware" in the board pack.
Sources
- Nozomi Networks — When ransomware turns off the HVAC
- CBC — Health Sciences Centre ransomware affecting facility systems
- Shared Health (Manitoba) public confirmation as quoted 10 August 2026 — Shared Health (Manitoba) public confirmation as quoted 10 August 2026