The hit medical drama The Pitt built its second season around a ransomware attack on a fictional Pittsburgh hospital, and on the night the show picked up a stack of Emmy nominations, that storyline is getting a real-world fact check. The setup: a hospital CEO walks into a chaotic ER, announces that two nearby hospitals have been hit by ransomware, and tells his own staff they’re taking every system offline as a precaution. What follows is a stretch of paper charts, fax machines, and clinicians relearning how to work without the technology they’ve built their careers on.
That question, whether Hollywood got the cyberattack right, was the center of a recent episode of the Amplitude of Tech podcast, in conversation with David Jost, VP of Cybersecurity at Amplix, who works directly with healthcare and other regulated clients on incident response and tabletop exercises. Jost walked host Shawn Cordner through what the show gets right, what it simplifies for TV, and the one question he thinks every CISO and CIO should be asking before their next drill.
| Quick Answer The Pitt’s Season 2 cyberattack storyline holds up: proactively shutting down hospital systems, reverting to paper charts and fax machines, and losing the “digital connective tissue” between departments all mirror real incident response, according to Amplix VP of Cybersecurity David Jost. Where the show compresses reality is the timeline; real remediation rarely wraps in a single shift. The biggest gap he saw wasn’t technology, it was that no one on screen had actually rehearsed the downtime plan before they needed it. |
The Setup: A Hospital Takes Itself Offline
Pittsburgh Trauma Medical Center, the hospital at the center of The Pitt, takes itself offline proactively after a sister facility in the region is hit by ransomware. Jost, a self-described fan of the show who has watched the season more than once, said the storyline earns points for what it doesn’t show.
“We never needed to see the hacker,” Jost said. “What we are doing throughout this whole season is we’re experiencing the incident through the consequences.” Instead of asking what malware variant is spreading, the staff is asking a much more human question: Where’s my lab result? That, Jost said, is exactly how a real breach feels from inside a hospital: not a technical mystery, but a slow erosion of trust in every system you depend on.
Was Shutting Down the Right Call?
Jost won’t call the proactive shutdown a clean win. “I’m gonna answer with a very definitive potentially,” he said. The decision hinges on the threat itself, how connected systems are to each other, and whether credentials can be contained quickly.
In healthcare specifically, that calculation carries extra weight. Disconnecting systems isn’t purely a risk decision, it’s a patient-care decision. “Containment isn’t simply a technical decision when disconnecting,” Jost said. “It affects patient care.” His broader point: organizations shouldn’t box themselves into an all-or-nothing choice between staying fully online or going completely dark. Segmentation, drills, and rehearsed scenarios give teams more options in the moment.
Why Ransomware Clusters Around Holidays and Regional Hospital Networks
The show sets its attack over a Fourth of July weekend, and Jost said that timing is deliberate on the attackers’ part, not just the writers’. Holiday weekends bring lighter staffing, higher patient volume, and less availability of the people who’d normally catch something unusual.
Attackers also lean on the same psychological pressure that gets a kid past one parent by asking the other. “All of the things that increase the likelihood are things like making something urgent, having it happen right away, hitting people at a place where they are less likely to be paying attention,” Jost said. Regional clustering, hitting multiple hospitals in the same metro area, compounds that pressure, since patients and staff have fewer alternatives to fall back on.
Going Analog: What Real Hospital Downtime Looks Like
Once systems go dark, the show leans into fax machines and paper charts, and Jost said that part is not exaggerated for drama. What’s understated is how much harder the reconciliation is afterward. “Everything that you have done during this time… is now also in two different universes,” he said. “It’s in your digital and it’s in your analog. How are you going to bring that all together?”
Jost draws a distinction between having a downtime procedure and having downtime capability. A binder full of instructions means little if no one has tested whether the forms are current, whether staff know how to use decades-old equipment, or whether the plan actually holds up under pressure.
The 98% Problem: AI Governance Without a Safety Case
One throwaway line in the show, a character citing 98% accuracy for an AI diagnostic tool, caught Jost’s attention immediately. “From a governance perspective, 98% alone tells me little to nothing,” he said. “So, 2% wrong about what? And with what consequences?”
His framing applies well beyond a hospital plot: accuracy is a performance metric, not a safety case. Whether a 2% error rate is tolerable depends entirely on what happens when the system is wrong, and whether a human is positioned to catch it before it matters.
HIPAA Compliance in the Middle of a Crisis
Asked whether hospitals get any slack on HIPAA during an active incident, Jost was careful not to overstate his own authority on the legal specifics, but was clear on the principle. “HIPAA from a HIPAA security standpoint, it’s not a certification,” he said. “It’s looking at where are you at in terms of managing and securely doing what you need to do to be able to manage the risk.”
In practice, that means organizations are judged on whether they’ve been doing regular security risk assessments and following the HIPAA Security Rule all along, not just on how they behaved during the crisis itself.
The One Question Before Your Next Tabletop Exercise
Jost’s advice for any CISO or CIO watching the episode boils down to a single test: “If our most critical digital systems disappeared right now, how long could we continue delivering safe care?” The answer, he said, can’t come from a conference room. It has to come from actually testing one critical workflow end to end without the technology, then another.
He also reframed the cost conversation. Instead of asking what a tabletop exercise costs (ROI), he asks what happens if the organization skips it (cost of inaction, or COI). Most organizations should run a tabletop exercise at least annually, more often as staff, systems, or the threat landscape change, and the goal isn’t a perfect drill. “If every tabletop goes perfectly… then the scenario that you have set up probably isn’t difficult enough,” Jost said.
Grading The Pitt
In the episode’s lightning round, Jost graded the fictional hospital’s preparedness a C-minus, largely because clinical leadership with institutional knowledge of the facility wasn’t brought in soon enough. He graded the response itself a B-plus, crediting the staff for keeping calm and executing under pressure once the crisis hit.
The gap between those two grades is the real lesson: strong execution in the moment can’t fully make up for preparation that wasn’t tested ahead of time.
How Amplix Can Help
The Pitt is fiction, but the underlying pressure it dramatizes, an unplanned shutdown, a scramble to go analog, and a governance gap around AI, is not. Amplix’s cybersecurity practice works with healthcare and other regulated clients to build the incident response plans and tabletop exercises that turn a downtime procedure into real downtime capability, long before it’s tested by an actual attack.
Contact Amplix today to design a tabletop exercise for your organization, or explore our cybersecurity capabilities to see how we help clients build cyber resilience before an incident, not after one.
Frequently Asked Questions
Is the cyberattack storyline in The Pitt realistic?
According to Amplix VP of Cybersecurity David Jost, yes. Proactively shutting down hospital systems, losing digital connectivity between records and labs, and falling back on paper charts and fax machines all reflect real ransomware incident response. The show compresses the recovery timeline for drama, but the underlying pattern is accurate.
What is a cybersecurity tabletop exercise, and how often should hospitals run one?
A tabletop exercise is a simulated incident-response drill where a team walks through how it would handle a specific crisis, such as a ransomware attack, before one actually happens. Most organizations should run one at least once a year, and more often when staff, systems, or the threat landscape change.
Does HIPAA still apply during an active ransomware attack?
Yes. The HIPAA Security Rule isn’t a certification that gets suspended during a crisis; it’s a standard organizations are held to based on how well they managed risk beforehand, including regular security risk assessments and documented governance.
How long does it typically take to recover from a hospital ransomware attack?
There is no single answer. Recovery time depends on the scope of the attack, the organization’s backup and business continuity plans, and how quickly digital and analog records can be reconciled once systems come back online. Recovery is a longer process than the moment screens turn back on.
What’s the difference between a downtime procedure and downtime capability?
A downtime procedure is a written plan for operating without technology. Downtime capability is proof, through actual testing, that staff can execute that plan under real conditions. Having a binder on a shelf is not the same as having run the drill.
Why do ransomware attacks often target hospitals during holidays or in regional clusters?
Attackers exploit periods of lighter staffing, higher patient demand, and reduced attention to detail, all of which are more common on holiday weekends. Targeting multiple hospitals in one region at once increases pressure further, since patients have fewer alternative facilities to turn to.
