UHSP CISO Beat LockBit: $1.25M Demand, $0 Paid [2026] | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware

A university CISO just told the cybersecurity press exactly how he refused to pay a $1.25 million LockBit ransom demand and still got every system back online. In an interview published September 14, 2026, Infosecurity Magazine sat down with Zach Lewis, CIO and CISO of the University of Health Sciences and Pharmacy (UHSP) in St. Louis, to walk through the incident response and recovery playbook that carried the school through a real LockBit ransomware attack. The interview lands as ransomware payment rates keep sliding and education institutions keep absorbing some of the sector’s steepest recovery bills, according to Sophos data reported by SecureWorld.

Lewis’s account, pieced together across the Infosecurity Magazine interview and earlier reporting from health-IT outlets HCInnovationGroup and This Week Health, is unusually detailed for a ransomware post-mortem. Most victim organizations say almost nothing publicly. UHSP’s team went the other way, naming the ransom figure, the negotiated counteroffer, the exact backup tier that saved them, and the configuration gap that let LockBit in. That level of disclosure gives CISOs at other small and mid-size organizations a rare, specific blueprint instead of the usual vague warnings.

A retrospective interview becomes today’s cybersecurity news

The attack itself dates back to 2023, but the reason it’s news on September 14, 2026 is timing. Infosecurity Magazine’s interview format packages a completed incident into a leadership case study, and it’s landing at a moment when boards and CFOs are asking sharper questions about ransomware readiness than they did three years ago. UHSP’s answer, delivered by its own CISO, doubles as a live rebuttal to the assumption that paying a ransomware gang is the fastest way back online.

Lewis described the opening move in blunt operational terms rather than crisis-mode panic. “The first move was to open negotiations with the threat actor to verify their claims,” he told Infosecurity Magazine. That single decision, treating the attacker’s claims as unverified rather than gospel, shaped everything that followed, including the discovery that LockBit’s affiliates were bluffing about how much data they actually held.

Inside the LockBit attack on UHSP

According to the HCInnovationGroup account, LockBit’s affiliates first got a foothold in UHSP’s environment on April 1, 2023, and sat undetected for roughly 13 days before the intrusion progressed. Lewis has described being woken by a call reporting systems down, an early-morning moment This Week Health places at around 3 a.m. Data exfiltration activity followed around June 12, 2023, and full remediation wrapped in the first week of July 2023, a multi-month arc that shows how long a modern ransomware case actually runs once you count negotiation, forensics, and rebuild.

The attack didn’t stay contained to servers and student records. HCInnovationGroup’s reporting lists Active Directory, on-premises services, building automation controlling heating and cooling, physical security systems including cameras and door badges, lighting systems, and user account management as all affected. Cloud-based and SaaS systems stayed up, and students kept access to classes and homework submission throughout, an early signal that UHSP’s cloud migration strategy was already paying off before the attack even started.

The $1.25 million demand, and why UHSP said no

LockBit’s affiliates opened with a $1.25 million ransom demand, according to both HCInnovationGroup and This Week Health’s reporting. During negotiations that figure came down to $750,000, per HCInnovationGroup. UHSP paid none of it. Zero dollars changed hands.

That refusal wasn’t a gamble made on principle alone. It rested on a specific technical asset: an isolated, offsite backup tier the attackers couldn’t reach. Lewis put it plainly to HCInnovationGroup: “I’ll call it the chef’s kiss. It kept us alive and functioning. Without it, we would not have been able to restore.” When your recovery path doesn’t depend on the attacker’s decryption key, refusing to pay stops being a moral stand and becomes a straightforward operational decision.

The bluff: how attackers inflated stolen data by roughly 190x

One of the more useful details in Lewis’s account is how aggressively LockBit’s affiliates lied about what they’d actually taken. HCInnovationGroup reports the attackers’ data claims escalated from 75 GB to 170 GB to a final claim of 380 GB during negotiation. This Week Health’s account matches the opening and closing figures: 75 GB claimed initially, roughly 380 GB claimed by the end. The real number, once UHSP’s team dug in, was just over 2 GB by HCInnovationGroup’s count, or 2.5 GB per This Week Health, containing four Social Security numbers.

“They were bluffing the whole time,” Lewis told This Week Health. UHSP’s team verified the actual scope, notified insurance and the FBI, and reached out directly to the four individuals whose Social Security numbers turned up in the stolen data, per HCInnovationGroup. Scaling the response to the real exposure, instead of the inflated one the attackers advertised, kept the incident from ballooning into a mass breach-notification event it never actually was.

Three tiers of backup, one survivor

UHSP ran a three-tier backup architecture going into the attack, and only one tier came out intact. HCInnovationGroup’s reporting breaks it down: a primary on-premises backup tied to the same authentication system LockBit had already compromised, a secondary on-site backup that attackers destroyed outright, and a tertiary, isolated offsite copy stored in Backblaze B2 cloud storage. That third tier is what UHSP restored from.

The lesson Lewis draws from that near-miss is about access, not just storage. “I don’t want to be in a situation again where I can’t access my backups,” he told HCInnovationGroup. A backup an attacker can reach and delete isn’t really a backup, it’s just another copy sitting inside the same blast radius.

# Illustrative backup-tier isolation check (conceptual, not UHSP's actual config)
# Goal: confirm at least one backup destination cannot be reached
# from the same identity/credential domain as production.

for tier in primary secondary tertiary; do
  auth_domain=$(get_backup_auth_domain $tier)
  if [ "$auth_domain" == "$PRODUCTION_AD_DOMAIN" ]; then
    echo "WARNING: $tier backup shares production credentials"
  fi
  if [ "$(is_network_reachable_from_prod $tier)" == "true" ]; then
    echo "WARNING: $tier backup is network-reachable from production"
  fi
done

What broke: a firewall migration blind spot

The root cause reads like a case study in how small configuration drift becomes a full-blown incident. This Week Health reports that a VPN access control was lost during a migration across three successive firewalls. The configuration looked correct on review, but a blank limitation field meant anyone in the environment could connect over VPN. “It’s funny how just a couple things have to line up at just the right time,” Lewis said.

HCInnovationGroup’s account fills in the next step of the chain: a compromised personal employee laptop accessed the network over that VPN gap after a phishing credential theft, and the attacker then escalated privileges using cached credentials on a server to reach the hypervisor layer. Hypervisor-level access is close to a worst case for a defender, since it lets an attacker touch every virtual machine a host runs rather than one system at a time.

UHSP’s fix wasn’t a one-time patch. Lewis told HCInnovationGroup the organization now “bake[s] in a little more time now in our environment when we do a project to validate that configurations are true,” turning a scheduling habit into a security control. Post-incident, UHSP also rolled out passwordless authentication, added data security posture management tooling to flag sensitive files automatically, and tightened access controls on browser-based SaaS applications, according to This Week Health.

The real cost of saying no

Refusing to pay didn’t mean the incident was free. HCInnovationGroup puts UHSP’s total out-of-pocket cost at approximately $300,000, spread across recovery fees, insurance deductibles, employee hours, and legal fees. That’s still less than half of LockBit’s original $1.25 million demand, and well under the $750,000 negotiated figure, though it’s an apples-to-oranges comparison since recovery costs and ransom payments solve different problems and don’t guarantee the same outcome.

How UHSP’s numbers stack up against 2026 ransomware benchmarks

UHSP’s 2023 incident predates the newest industry benchmarks, but lining it up against 2026 data shows how unusual the outcome was. Sophos’s 2026 ransomware research, summarized by SecureWorld and CyberSecurityStats.com, put the 2026 median ransom demand at $698,000, down from $1.32 million in 2025, and the median payment among victims who did pay at $769,000. Sophos also found 48% of victims whose data was encrypted chose to pay, while a separate Coalition dataset cited by ConversationalGeek put the payment rate as low as 14% across a broader incident set.

UHSP’s recovery cost sits well under the broader 2026 average, and dramatically under education’s sector-specific average. That gap is the entire argument for isolated, tested backups: the difference between a $300,000 bad quarter and a multi-million-dollar rebuild often comes down to whether one backup copy sat outside the blast radius.

Higher education is absorbing some of ransomware’s steepest bills

UHSP’s experience fits a wider pattern in education-sector ransomware costs. Sophos’s 2026 State of Ransomware in Education report, cited by SecureWorld, found average recovery costs in education reached $2.26 million, above the $1.7 million overall survey figure. Higher education specifically averaged $1.99 million to rectify an attack, more than double its own $0.90 million average from 2025. Lower education institutions averaged $2.46 million.

Recovery time tells a similar story. The same Sophos research found 26% of education providers needed one to three months to fully recover, roughly double the 14% rate across all sectors combined. Universities and colleges run flat, identity-heavy networks connecting research labs, dorms, health clinics, and financial systems, which gives ransomware operators more lateral-movement paths than a typical corporate network segments off.

Historical context: LockBit’s long comeback from Operation Cronos

LockBit wasn’t a fringe player when it hit UHSP, and it isn’t one now. In February 2024, an international law enforcement action known as Operation Cronos, detailed in an Europol news release, seized 34 servers linked to the group and froze more than 200 cryptocurrency accounts tied to its operations. Europol described the action as disrupting the LockBit ransomware group’s criminal operation “at every level.”

The takedown didn’t end LockBit’s influence. Its leaked Black builder from September 2022 kept circulating among unrelated crews, and successor administrators launched LockBit 4 and later LockBit 5 on rebuilt infrastructure, according to industry reporting on the group’s post-Cronos trajectory. Volume under the LockBit name in 2026 is smaller than its pre-takedown peak, but security researchers tracking the ecosystem argue the underlying threat didn’t shrink so much as scatter across LockBit-derived encryptors now used by other operators. UHSP’s 2023 incident happened well before Cronos, when LockBit was operating at its historical peak as the most prolific ransomware-as-a-service brand tracked by CISA.

Why ransomware payment rates keep falling in 2026

The market context around UHSP’s disclosure matters. Ransomware payment rates and demand sizes have been trending down for two straight years, even as attack volume hasn’t slowed. Sophos’s 2026 figures, again via SecureWorld, show the median ransom demand fell from $2 million in 2024 to $1.32 million in 2025 to $698,000 in 2026, a 65% drop over two years. Median payments fell a similar amount, down 62% to $769,000 from $1 million the prior year.

Cyber insurers and incident response firms deserve some of the credit. ConversationalGeek’s 2026 ransomware statistics roundup cites negotiation-firm data showing professional negotiators bring the average final payment down 65% from the opening demand, landing around $355,000. UHSP’s own 40% discount, from $1.25 million to $750,000, is a more modest cut than that average, which suggests even without a professional negotiator driving the number down, having a credible walk-away option (the isolated backup) did more to protect UHSP than the negotiation itself.

Competitive comparison: backup-first recovery versus pay-and-hope

UHSP’s approach sits at one end of a spectrum of ransomware responses that CISOs across sectors are choosing from in 2026. At the other end is the pay-first posture that Lewis pushed back on directly. “Their primary go-to in the event of a ransomware attack is to pay the ransom,” he told HCInnovationGroup, describing a pattern he sees elsewhere in healthcare and adjacent sectors. That instinct is understandable under pressure, but Sophos’s own data shows paying doesn’t reliably shorten recovery, since education organizations already face some of the longest recovery windows in the survey regardless of payment decisions.

A middle path, common among mid-size enterprises, blends professional negotiation with partial payment, aiming to buy a decryption key while limiting exposure. UHSP’s approach skipped that path entirely by removing the need for a decryption key. Lewis’s framing to HCInnovationGroup treated a major ransomware attack as effectively inevitable for any organization, arguing survival depends on fundamentals like multi-factor authentication, patching cadence, and truly recoverable, access-isolated backups rather than the newest security product on the market.

Lessons other CISOs are pulling from the UHSP case

Several specific, repeatable practices emerge from Lewis’s public accounts, and they map closely onto what security researchers have been telling CISOs for years, just with a real incident attached to prove they work:

• Treat every attacker claim as unverified until your own team confirms it, including how much data was actually stolen.
• Keep at least one backup tier authenticated separately from production identity systems, and confirm it’s not network-reachable from compromised hosts.
• Build configuration-validation time into every infrastructure migration project rather than treating it as optional overhead.
• Treat cached credentials and privilege escalation paths to the hypervisor layer as a top-tier risk, not a secondary concern behind endpoint detection.
• Loop in insurance and law enforcement immediately rather than waiting to see how negotiations unfold.

None of these are exotic. What makes UHSP’s case valuable is that a CISO went on the record showing exactly which of these fundamentals mattered most when an attack actually happened, rather than leaving it to hypothetical tabletop exercises.

Market impact: what this means for backup vendors and cyber insurers

Cases like UHSP’s carry commercial weight beyond the immediate incident. Backup and immutable-storage vendors increasingly use verified customer recovery stories as sales material precisely because falling ransom payment rates, down to $698,000 median demand per Sophos, are shifting the industry’s cost-benefit math away from paying and toward recovery infrastructure. Cyber insurers, meanwhile, have leaned on negotiation firms and forensic vendors to keep claim payouts down, a factor ConversationalGeek’s data suggests is already compressing average final payments by roughly two-thirds versus opening demands.

Education-sector IT budgets, squeezed by enrollment pressure and tighter public funding in many states, are a harder environment for this shift to take hold. A $1.99 million average recovery bill for higher education, per Sophos, is a difficult number for a small university to absorb even once, and UHSP’s roughly $300,000 outcome shows the gap between doing backup architecture right and doing it approximately right can run into the millions.

Five predictions for ransomware response through 2027

• More CISOs will go public with named, numbers-attached post-mortems like Lewis’s, as boards start rewarding transparency over silence following an incident.
• Median ransom demands will likely keep falling through 2027 as backup-first recovery becomes the default expectation rather than the exception, continuing the trend Sophos has tracked since 2024.
• Higher education recovery costs will stay elevated relative to other sectors unless universities meaningfully segment research, clinical, and administrative networks.
• LockBit-derived encryptors will keep circulating under new operator names even if the LockBit brand itself keeps shrinking, continuing the pattern researchers have already flagged since Operation Cronos.
• Firewall and VPN migrations will remain a leading initial-access vector, pushing more organizations toward mandatory post-migration configuration audits as a compliance requirement rather than a best practice.

Frequently asked questions

Who is Zach Lewis and what organization does he work for?

Zach Lewis is the CIO and CISO of the University of Health Sciences and Pharmacy (UHSP) in St. Louis. He led the school’s response to a LockBit ransomware attack and has since spoken publicly about it in interviews with Infosecurity Magazine, HCInnovationGroup, and This Week Health.

Did UHSP pay the LockBit ransom?

No. LockBit’s affiliates initially demanded $1.25 million, later negotiated down to $750,000, and UHSP paid $0, recovering instead from an isolated offsite backup, according to HCInnovationGroup’s reporting.

How much data did the attackers actually steal from UHSP?

Roughly 2 to 2.5 GB, containing four Social Security numbers, despite attackers claiming as much as 380 GB during negotiations, per HCInnovationGroup and This Week Health.

What caused the initial breach at UHSP?

A VPN access control was lost during a migration across three successive firewalls, leaving a configuration gap that let an unauthorized device connect. A compromised employee laptop, reached via phishing, then used cached credentials to escalate privileges up to the hypervisor layer, according to This Week Health and HCInnovationGroup.

How does UHSP’s ransom demand compare to 2026 industry averages?

UHSP’s $1.25 million demand ran nearly double the 2026 median ransom demand of $698,000 reported by Sophos and summarized by SecureWorld, though UHSP’s incident predates that benchmark by roughly three years.

Is LockBit still active in 2026?

Yes, in a reduced form. Law enforcement’s February 2024 Operation Cronos, per Europol, seized 34 servers and froze over 200 cryptocurrency accounts linked to the group. Successor administrators have since relaunched the brand as LockBit 4 and LockBit 5 on rebuilt infrastructure, though at lower volume than before the takedown.

What did UHSP change after the attack?

The university migrated more applications to cloud and SaaS platforms, adopted passwordless authentication, deployed data security posture management tooling, tightened SaaS access controls, and built extra time into infrastructure projects specifically to validate configurations, according to This Week Health and HCInnovationGroup.

What percentage of ransomware victims pay in 2026?

Estimates vary by methodology. Sophos’s survey-based research puts it at 48% of victims whose data was encrypted, while a Coalition incident dataset cited by ConversationalGeek puts it closer to 14% across a broader victim population.

Related Coverage