How a University CISO Refused a $1.25M LockBit Ransom Demand

When LockBit encrypted the University of Health Sciences and Pharmacy in St. Louis in April 2023, the group led with a $1.25 million demand. Zach Lewis, the school's CIO and CISO, refused to pay. The refusal made the headline, but on episode 12 of the Full Metal Packet podcast, it is the smaller half of the story. 

Zach treats his own incident to make a less dramatic, more useful point. A serious ransomware attack is usually closer to inevitable than not, and the organizations that survive are the ones that get the unglamorous fundamentals right before the note appears. 

He highlights that attacks keep rising year over year, with payments falling only because backups have improved, not because anyone got better at stopping the intrusion.

TL;DR

• Zach treats a major ransomware attack as eventually inevitable, and argues survival comes down to fundamentals like MFA, patching, and recoverable backups rather than the newest buzzword.
• LockBit encrypted UHSP at the hypervisor root, so the per-server EDR never tripped and the intrusion ran unseen for nearly two weeks.
• The $1.25M refusal only held because the team recovered, and recovery nearly failed when the secondary backup was deleted, the primary was locked behind a downed Active Directory, and the password manager was itself encrypted.
• His build-from-scratch priorities: AI-enabled email security, data governance, and tested, resilient backups.
• He wants the industry to talk openly about breaches, because attackers already share what works while defenders mostly stay silent.

The Attack That Looked Like a Hardware Failure

The first sign was ordinary. On April 13, 2023, a team member reported that on-site systems were unavailable. UHSP runs SaaS-first, so students kept working unaware while internal operations like building automation and badge access went dark. 

With end-of-life hardware already slated for replacement, the team assumed equipment had failed and began troubleshooting. Days later they found a README file in the root of the hypervisor, the layer running every virtual server. It was from LockBit.

Encrypting at that root rather than server by server is why the endpoint detection never fired, because no ransomware executed where the sensors were watching. Forensics placed initial access near April 1: a phished personal device, stolen credentials that matched a work login, entry over the VPN, then a climb through cached higher-privilege credentials until the attacker reached the hypervisor. The group even kept exfiltration quiet, ultimately dropping about 2GB despite claiming 380GB.

The part decision-makers should sit with is what happened next, because a textbook recovery nearly became a forced payment. UHSP had backups. Each layer failed in turn:

• The primary was intact but needed Active Directory to authenticate, and Active Directory was down.
• The secondary backup had already been found and deleted by the attackers.
• The local password that would bypass that lived in the company password manager, which sat on a now-encrypted server.
• The off-site, off-domain third backup had its password in that same encrypted manager.

The recovery survived on a single policy violation. One team member had saved that off-site credential to a personal password manager, and it turned out to be the only copy anyone could reach. From there the team restored Active Directory onto a high-end machine borrowed from the campus esports lounge while they waited weeks for delayed hardware.

Refusing to Pay Was a Business Decision

UHSP had rehearsed a no-pay position in a December 2022 tabletop, but Zach is clear that a stance settled in a conference room is tested very differently when a group is holding what might be sensitive research or student data. He treats the choice as a business decision, measured against what the attacker actually has and how fast you can operate without them.

The negotiation showed why proof matters. Working through threat negotiators, the team stalled and asked for evidence, receiving only file names. As the attackers sensed recovery underway, the demand fell from $1.25 million to $750,000, rebranded as a fee to not publish. The claimed haul had ballooned from 75GB to 180GB to 380GB along the way, against the roughly 2GB that eventually surfaced.

Zach is candid that his calculus is not universal. Hospitals often pay immediately, because downtime can cost a patient their life and attackers know it, which helps explain why healthcare sits near the top of the target list. 

He also digs into the policy questions the industry keeps circling. Should the US criminalize ransom payments, which might starve the model over time but would create a brutal transition where organizations cannot recover? Should ransomware groups be labeled terrorists to give the government more reach? He flags the catch: most cyber insurance policies exclude acts of terror, so that label could quietly cut off the payouts organizations rely on to rebuild.

Backups Are the Real Battleground

If the incident has one throughline, it is that backups decide whether refusing to pay is even an option, and most organizations treat them more casually than that. Zach pushes on the assumptions people hold. Immutable backups are only so protective, because a copy you cannot edit can often still be deleted, and an attacker who cannot corrupt your data will simply remove it. Some vendors now require multiple approvals and quotas before a deletion goes through, which he sees as where the category needs to head.

His baseline is the 3-2-1 approach, with at least one copy fully off-network and ideally captured by a different method so a single compromised process cannot poison everything. Backups also only count if you have tested restoring them. UHSP now runs restore tests quarterly from every location and logs how each goes, because plenty of organizations back up faithfully and have never once confirmed that the data comes back. He stresses mean time to recovery too: if a thousand servers are down, how many can you restore at once, and how long does that really take under pressure?

The cautionary tale he shares is of an organization whose backup process encrypted data in transit, so every validation check passed while the stored copies were quietly useless. The takeaway is to verify the recovery itself, not just the job status.

If You Were Building a Program From Scratch

Asked what he would stand up first in a brand-new security program, Zach leads with the unglamorous fundamentals. His priority stack, roughly in order:

• Email security is still the top initial vector for higher ed and most industries. He argues the old line that there is no technical fix for a human problem is aging out, and that modern AI-enabled email security can keep most phishing and business email compromise out of inboxes before a user ever gets the chance to click.
• Data governance, ideally a DSPM approach, so you always know what data you hold and where it lives. His own incident turned partly on not knowing what was sensitive while staring at a list of file names.
• Resilient, tested backups, paired with the ability to patch quickly across the fleet.
• Identity controls, since cached credentials escalated the UHSP attack. He leans on just-in-time access, PAM and PIM with justification and alerting, tiered admin levels, and password managers that log privileged users in without ever exposing the password to save or cache.
• Scoped service accounts held to least privilege, with backup writers given no ability to delete what they write.

Know Who Is Coming for You

Zach closes the threat picture by separating motives, because the right defense depends on who is targeting you. Financially driven ransomware crews want to be paid, which is why their support can be oddly professional and their demands negotiable. Nation-states are a different problem, and he sketches how their goals diverge:

• Iran leans toward destructive, wiper-style attacks.
• North Korea funds weapons programs with stolen cryptocurrency.
• China focuses on lifting intellectual property and research.
• Russia is motivated by money and by sitting quietly inside systems to watch.

The hardest adversary, he notes, is the one you cannot negotiate with: an ideologically driven attacker who is only there to delete everything gives you nothing to bargain for. 

As for LockBit itself, law enforcement disrupted and indicted parts of the group, and Zach notes the survivors regrouped and banded with other disrupted crews into a loose cartel, less prolific than before but still operating.

Why He Is Talking About It at All

The reason Zach wrote a book about his own worst week is the same reason he came on the show. Most organizations stay silent after a breach, from embarrassment or legal caution, while attackers freely compare notes on who paid and which targets were soft. Silence hands the offense its biggest advantage.

His analogy is aviation, which became the safest way to travel because every crash was investigated and every finding written into procedure. Cybersecurity can be the same if practitioners will say out loud how they were hit and what actually worked. 

Alex adds the point that keeps people quiet: nobody hands a CISO a trophy for a year in which nothing happened, but everyone looks for someone to blame when something does.

The full episode goes well beyond this recap.

Zach Lewis is the CIO and CISO at the University of Health Sciences and Pharmacy in St. Louis, and the author of Locked Up: Cybersecurity Threat Mitigation Lessons from a Real-World LockBit Ransomware Response.

Full Metal Packet is hosted by Control D co-founders Yegor Sak and Alex Paguis. Watch the full episode on YouTube, or listen on Apple Podcasts, Spotify, or wherever you get your podcasts.