Air Ambulance Grounded While a Patient Waited

TAMARACK FALLS, Ont. — November 13, 2026 — At 3:12 a.m., the phone at the Tamarack Falls air base rang for a patient who needed to fly, and nobody could answer it properly. The dispatcher on duty could see the caller’s number on the screen. She could not see the patient’s details, the crew roster, or which helicopter was ready to go. Every one of those screens had gone black an hour earlier, and the words on the last one still lit were the ones nobody at the base had ever expected to read.

The screens were locked. The helicopters were not allowed to fly.

Tamarack Air Rescue is a fictional air ambulance service covering the remote communities north of Tamarack Falls, a fictional town of about 9,000 people in northern Ontario. When the roads are long and the weather is bad, its helicopters are the only fast way to get a seriously ill patient to a hospital. On Wednesday night, a 68-year-old woman in the fictional community of Alder Creek, two hours by road from the nearest hospital, needed an urgent transfer after a suspected stroke. The helicopter never left the ground.

One phishing email grounded the helicopters — and a patient who needed to fly waited on the ground instead.

The service says the trouble started with an email sent to the dispatch desk late on Tuesday afternoon. It looked like a routine message from the fictional company that maintains the base’s radios, asking a dispatcher to open an attached work order. She did. Within the hour, the ransomware hidden inside it had spread from the office computers to the dispatch system itself, locking the crew schedules, the patient records, and the flight-planning software behind a demand for payment.

“We train our crews for engine failures and whiteouts. We did not train them for this,” said Mara Ellison, the fictional service’s operations manager. “The helicopters were fine. The pilots were ready. The fuel was in the tanks. But we could not prove to ourselves, on paper, who was fit to fly, which aircraft had been checked, or where the patient was. You do not send a helicopter into the dark on a guess. So we stayed on the ground, and a woman who needed us waited for a road ambulance instead.”

The patient was eventually taken by road to a hospital in the fictional city of Port Marrow, arriving more than four hours after the first call. The hospital says she is stable and recovering. The service says no patient records were published and no ransom was paid. Its dispatch system stayed offline through the night while its fictional IT contractor rebuilt it from backups, and flights resumed on Thursday morning.

The aircraft were ready to fly. The system that says who flies, and where, was not.

The attack did not touch a single helicopter. It did not need to. An air ambulance is not just an aircraft — it is a chain of small decisions made quickly: which crew is rested, which aircraft is fuelled, which hospital has a bed, which patient goes first. Lock the screens that hold those decisions and the helicopters become expensive ornaments on a helipad, no matter how good the weather is.

“People picture a cyberattack on a hospital as someone stealing records,” said Dr. Lena Voss, a fictional health-systems cybersecurity researcher who studies attacks on emergency services. “But the attacks that hurt patients most are the ones that simply stop the service from working. A locked dispatch screen is a grounded helicopter. A frozen roster is a crew that cannot legally fly. The harm is not a data breach. It is time — and in emergency medicine, time is the one thing you cannot get back.”

In this fictional case, the service says the phishing email reached the dispatch desk because the base’s email filters had not been updated in months, and the dispatch computers shared the same network as the office email. The ransomware moved from one to the other in under an hour. The service says it will now separate the dispatch system from office email entirely, and keep a paper copy of the crew roster and aircraft checks at the base at all times.

The defence is not a sharper eye for suspicious emails. It is making sure one click cannot ground the whole service.

That advice applies well beyond one air base. Across Canada, small emergency services, clinics, and rural hospitals all run their critical work on the same networks as their office email, often with a handful of staff and no full-time IT team. When one of those networks goes down, the service it supports goes down with it — and the people waiting for help are the ones who pay for it.

Lessons Learnt

• Keep dispatch systems off the office email network. If the computers that plan flights share a network with email, one bad attachment can lock both. Separate them so an email problem stays an email problem.
• Update the email filter, and test it. A filter that has not been updated in months will miss new phishing emails. Check it regularly, and send your own test phishing emails to see who clicks.
• Keep a paper backup of the essentials. A printed crew roster, aircraft checks, and hospital contacts let a base keep flying while the computers are down. Update it every shift.
• Practise the offline plan. Run a drill where the dispatch screens are off and the team works from paper. If the first time you try it is during a real attack, it will be too slow.

The fictional service says its helicopters are flying again, and the patient from Alder Creek is recovering in hospital. The base is back to full service. The night it spent on the ground is the part it cannot take back.

Watching the perimeter — and what slips past it.

ODTN News note: ODTN.News is a fictional news platform set within the Operation: Defend the North universe. All names, organizations, quotes, and events in this article are entirely fictitious. Any resemblance to real people, companies, or incidents is purely coincidental. The cybersecurity challenges it represents are very real.