Ireland's Health Service Executive (Conti)
A malicious spreadsheet opened in March gave Conti ransomware operators access to the HSE. They moved through the network for about eight weeks before encrypting systems in May, sending hospitals back to paper. The post-incident review found earlier alerts had not been acted on.
Turns early warning signs into finished investigations so they get acted on, and hunts the weeks of lateral movement between first access and encryption.