Nipigon hospital is on paper procedures. That is what a restore test is for.

Nipigon District Memorial Hospital, a small site on the north shore of Lake Superior, said this week that ransomware hit its IT systems. Staff are on manual procedures. The outpatient lab and diagnostic imaging are closed until further notice. Patients were told to expect longer waits. That is what a failed restore looks like when the building still has to take emergencies.

What the hospital has said

The hospital posted that it activated incident response and business continuity, is working with outside specialists and partners, and is in touch with law enforcement. CEO Shannon Cormier told local press that priorities are safe patient care, containment, and secure restoration. Mayor Suzanne Kukko said the hospital confirmed ransomware and that some files that may hold personal information and personal health information were encrypted.

They have not named a group. They have not said whether data left the building. They have not given a restore date. They said they will notify people if the investigation says they must. Those are the right omissions. Inventing a brand from a leak site would not help a 37-bed hospital (15 acute, 22 long-term care) that still runs a 24/7 emergency department.

Why small sites get hit the same way large ones do

Healthcare ransomware in Canada is not only downtown teaching hospitals. Comparitech's 2025 count had 10 attacks on Canadian providers and another 8 on related businesses. The playbook does not care that Nipigon serves a wide rural and First Nations catchment. It cares that clinical systems, imaging, and lab work share an identity store and a backup job that may never have been restored in anger.

When imaging and lab close, the failure is recoverability, not a missing endpoint agent. Manual downtime procedures keep people alive. They do not replace a dated restore of the PACS or the LIS. Insurers and privacy commissioners will ask the same two questions: what was encrypted, and what can you prove you got back.

What other operators should take from this

• Write down which clinical services die if the network does. Lab and imaging are usually on that list. Practice the paper path before you need it.
• Prove a restore of those systems, not a screenshot of a backup console. Offline or immutable copies. The same admin who runs production should not be able to delete them in one night.
• If you are a vendor or a regional partner to a small hospital, assume your remote-access tools are in scope the week they have an incident.
• Do not treat a rural site as low value. Patient records and the disruption itself are the product.

Bottom line

A ransomware week at a northern Ontario hospital is a backup story with a waiting room. Forensic Five is in St. Albert, Alberta. We review recoverability and write it down so a board or an insurer can read it. We hope Nipigon gets imaging back quickly. The rest of us should not wait for our own notice to test a restore.