The Firewall Saw the Attack. The Business Didn’t.
What the Enzo Biochem Breach Teaches Biotech Leaders About 24/7 Security
The most important lesson from the Enzo Biochem ransomware attack is not that ransomware is dangerous.
Every CISO already knows that.
The lesson is much more uncomfortable:
Security technology can identify suspicious activity while the business remains effectively blind.
That distinction should concern every biotech Director of IT, security leader and CISO trying to protect a growing company with a small internal team.
In April 2023, attackers gained access to Enzo Biochem’s network. According to the New York Attorney General’s investigation, they used two administrator credentials shared among five employees. One of those credentials had reportedly not been changed in ten years. After gaining access, the attackers installed malicious software on Enzo systems.
Then something happened that deserves far more attention than the ransomware itself.
The malicious software began communicating with attacker-controlled servers. Enzo’s firewall identified tens of thousands of connection attempts as malicious and blocked them. Yet Enzo personnel did not become aware of the attackers’ activity until several days later because the company did not have a system or process in place to monitor for, or provide notice of suspicious activity.
Think about that.
The technology was producing evidence.
The problem was what happened after the evidence appeared.
The false belief: “We already have security tools”
This is where biotech leadership needs to challenge itself.
Having a firewall, EDR platform, SIEM, cloud-security platform or other security technology does not answer the most important question:
Who is accountable for deciding what an alert means and what happens next?
That distinction becomes critical after 6:00 p.m., on weekends and during holidays.
A growing biotech company may have excellent IT people. But excellent people still have finite capacity.
Your IT director may be managing Microsoft 365, cloud infrastructure, identity, vendors, laptops, applications, backups, scientists’ requirements, new hires, compliance requests and executive projects.
Now add continuous security monitoring.
The issue isn’t whether that person cares enough.
The issue is whether the operating model is realistic.
A company cannot claim to have 24/7 threat response simply because its technology runs 24/7.
Enzo shows what the gap can cost
On April 6, 2023, Enzo publicly disclosed that ransomware had affected certain IT systems. Days later it determined that data had also been extracted. Enzo ultimately identified unauthorized access to or acquisition of clinical test information involving approximately 2.47 million individuals, with Social Security numbers potentially involved for approximately 600,000 people.
The operational damage was not confined to an incident-response meeting.
Enzo later told investors that the incident severely curtailed its ability to perform clinical reference testing, forcing it to outsource much of that testing to third parties. The company said this negatively affected services revenue and increased outsourcing costs.
That is the part biotech executives should pay attention to.
Cybersecurity stopped being a technical issue.
It became an operational issue.
For another life-sciences organization, that same pattern could affect research workflows, cloud repositories, laboratory operations, manufacturing processes, clinical programs, partner data or intellectual property.
The specific asset changes.
The business consequence doesn’t.
An attacker who remains inside the environment longer gets more opportunity to discover what matters.
Then the financial consequences arrive
In 2024, Enzo agreed to pay $4.5 million in a multistate settlement related to its security practices and the breach.
In January 2025, Enzo also entered into a $7.5 million class-wide settlement agreement related to litigation arising from the cyberattack. Its filings also disclosed that its cyber-insurance carrier covered up to $3 million of incident remediation costs.
The important point isn’t simply that settlements cost money.
It’s that the original security failure creates a chain reaction:
- Incident response.
- Operational disruption.
- Outside forensic expertise.
- Legal expense.
- Regulatory attention.
- Customer or patient notification.
- Remediation.
- Litigation.
- Executive scrutiny.
- Potential insurance implications.
- And months or years of explaining what happened.
That is why measuring cybersecurity exclusively by what it costs each month misses the larger business equation.
The better strategy is not “buy another tool”
Suppose your firewall identifies malicious activity at 1:17 a.m.
What happens next?
- Does someone see it?
- How quickly?
- Do they have enough context to distinguish a real attack from noise?
- Who investigates the endpoint, user, identity, cloud session and network activity?
- Who has authority to isolate a machine, disable an account or block an indicator?
- Who calls the internal IT director?
- What happens if the first person doesn’t answer?
- How long before executive leadership becomes involved?
Those questions describe a security operating model, not a product.
For biotech companies without the budget or scale to staff a mature SOC internally, managed security services can fill that operating gap.
But leadership should demand more than “24/7 monitoring.”
That phrase has become almost meaningless.
The real question is whether the provider delivers 24/7 human investigation and response, backed by experienced analysts, documented escalation procedures and contractually defined response times.
An MSSP cannot guarantee that your company will never suffer a breach.
It can, however, be held accountable for whether qualified people are watching, investigating and escalating when something suspicious occurs.
That distinction matters.
Evaluate the response model, not the logo on the tool
When evaluating your current security operation or an outside provider, ask what happens to a high-severity alert at 2:00 a.m.
Ask what “response time” actually means.
An acknowledgment is not an investigation.
An automatically generated email is not incident response.
Forwarding an alert to an exhausted IT director does not create 24/7 coverage.
Determine whether analysts investigate identity activity, endpoints, network signals and cloud events together.
Determine who can contain a threat.
Review escalation paths.
Review after-hours procedures.
Review what information leadership receives after an incident.
Most importantly, ask for the actual response obligation.
How many minutes can pass between detection and qualified human investigation?
That is a far more valuable metric than the number of security products in the environment.
Growth exposes weak security operating models
A biotech company can survive with informal processes when it is small.
Then it grows.
- More researchers join.
- More cloud applications appear.
- More vendors receive access.
- More intellectual property accumulates.
- More investors ask questions.
- More endpoints and identities require protection.
The attack surface grows faster than the internal security team.
That is when yesterday’s acceptable security model becomes tomorrow’s business exposure.
The Enzo case should not make biotech leaders afraid of ransomware.
It should make them question something far more fundamental:
If suspicious activity started inside your environment tonight, would your security technology merely record it or would a qualified person recognize what was happening and do something about it?
If leadership cannot answer that question confidently, the problem isn’t another missing security product.
The problem is the operating model.
About Single Point of Contact
Single Point of Contact is an experienced MSP in the biotech industry and is a valuable partner, providing specialized knowledge in implementing robust backup strategies and ensuring network security and stability. With deep understanding of regulatory requirements such as HIPAA and FDA’s 21 CFR Part 11, Single Point of Contact safeguards sensitive research data, clinical trial information, and intellectual property. They offer tailored solutions, including automated backups, real-time monitoring, and disaster recovery plans, minimizing downtime and data loss. By managing security protocols, they protect against cyber threats, allowing biotech companies to focus on innovation while ensuring compliance and uninterrupted operations. This expertise enhances productivity and reduces risk. Contact us today to discover more about how we can help your biotech firm with DR, backup and security.
Biotech Podcast
On this podcast, we discuss data recovery. This episode explores the significant challenges biotech firms face in developing effective data recovery strategies. Topics include the importance of regular testing, rapid restoration capabilities, and the risks of inadequate planning. It highlights how speed and efficiency are crucial to uninterrupted operations, regulatory compliance, and maintaining trust in a data-driven industry. Tune in to the discussion.
Biotech YouTube
Subscribe to our YouTube channel. On a recent episode,” The Delay That Destroys Biotech”, Most biotech breaches aren’t discovered for months. And by the time they are, the damage is already done. In this episode, we break down what really happens during that silent window and why detection time, not prevention, defines your risk. If you can’t see it early, you can’t control it.
