Ransomware at a Wyoming Hospital: Lessons for Patients

In October 2019, a hospital system in Wyoming was among the health care organizations hit by a ransomware attack, an incident that disrupted computer systems and drew attention to how vulnerable local hospitals can be. The details of any single event matter less today than the pattern it illustrates. Hospitals, clinics and insurers have been repeated targets of ransomware because the cost of downtime is measured in patient safety, and because medical records are among the most valuable data a thief can steal. This article uses that incident as a lens: what ransomware is, how it affects patients, what happens to health data, and what ordinary people can do to protect themselves. For the wider picture, see our guide on patient information leaked by hospitals worldwide.

1. What ransomware is and how it works

Ransomware is malicious software that encrypts files or whole systems and demands payment for the key. A typical attack runs through several stages. Attackers gain access, often through a phishing email, stolen credentials or an unpatched system. They move through the network, locate valuable systems and backups, and then trigger encryption. A ransom note follows. In many modern attacks, criminals also copy data before encrypting, so they can threaten to leak it even if the victim restores from backups. This is called double extortion.

For a hospital, encrypted systems can mean the loss of access to electronic records, scheduling, imaging, labs and phone systems. Staff may revert to paper, divert ambulances or postpone procedures. That is why hospitals are attractive targets: downtime is dangerous, and attackers believe pressure to restore systems will lead to payment.

2. What the Wyoming incident taught observers

Reports at the time described a regional health system in Wyoming responding to a ransomware attack that affected computer systems and required staff to work around outages. The broader lesson was not a story about one place. It was a reminder that smaller and rural hospitals often have fewer security staff and thinner budgets, yet the same obligation to protect patients. If a facility near you suffers an attack, check official notices from the organization for what happened, rather than relying on rumors.

Since then, the picture has only grown more serious. The FBI’s Internet Crime Complaint Center received 1,008,597 complaints in 2025 and reported $20.877 billion in losses (ic3.gov), and its reporting includes ransomware and personal data breaches as separate categories. In 2025, 67,456 complaints involved personal data breaches, with about $1.31 billion in reported losses.

Curious what’s already out there? Wiperts’ 100% Free Diagnosis shows which data brokers are listing your name, home address and phone number. Check your exposure free — it takes about a minute.

3. What it means for patients

Disruption of care

During an outage you may face delays, rescheduled appointments or manual processes. If you are worried, call the facility using a number from its official website and ask how to reach your provider.

Exposure of health information

If attackers copied records, the data may include names, addresses, birth dates, government ID numbers, insurance information, diagnoses and treatment details. Unlike a password, medical history cannot be changed. Our article on what happens to your health data online describes how it moves.

Medical identity theft

Thieves use stolen identity details to get care, prescriptions or insurance payments. The victim may be left with inaccurate records, such as a diagnosis or allergy that is not theirs, and with bills they did not incur. That makes medical identity theft particularly hard to unwind.

Targeted scams

After a hospital incident, scammers send fake notices, billing demands and phone calls that reference the event. Never provide information on an incoming call. Contact the provider using a number you find independently.

4. How to protect yourself as a patient

Read the notice carefully

A real notification will explain what happened, what information was involved, what the organization is doing and what you can do. If you have doubts, verify it through the provider’s official website.

Review statements and explanations of benefits

Look for services you did not receive, providers you do not know and dates when you were not treated. Dispute errors with your insurer in writing.

Freeze your credit

A freeze blocks new credit accounts in your name and is free. See what a credit freeze is and the FTC’s guidance.

Secure your patient portal

Use a unique password and two-factor authentication. Check your portal for unfamiliar activity.

Request your records

Under HIPAA you generally have the right to access your records and to ask for corrections. The HHS Office for Civil Rights explains how to do this and how to file a complaint.

Report misuse

If someone has used your identity, file at IdentityTheft.gov and read our guide on how to report identity theft. Report scams at ReportFraud.ftc.gov.

Reduce what is public

Criminals combine stolen health records with public listings. Removing people-search profiles makes it harder to build a complete identity. Official opt-outs exist for Spokeo, PeopleConnect and That’s Them. Our guide on removing medical records from the internet covers health data specifically.

5. What hospitals should be doing

Patients cannot fix a hospital’s security, but they can recognize good practice. Strong organizations maintain offline backups, patch systems promptly, require multi-factor authentication, train staff to spot phishing, segment networks so one infection cannot spread everywhere, and test their incident response. They also communicate clearly after an incident. If your provider offers a patient portal, ask how they protect it. In the United States, HIPAA’s Security Rule sets requirements for covered entities, and breaches must be reported according to rules explained by HHS.

6. Should you ever pay a ransom?

Organizations face difficult decisions about paying. Law enforcement agencies discourage payment because it funds criminals and does not ensure recovery. As a patient or individual victim of an extortion message, do not pay and do not respond. Report it at ic3.gov and keep a copy of the message.

7. Why medical data is uniquely sensitive

A stolen card can be canceled, and a stolen password can be changed. A diagnosis cannot be reset. Medical data can also be used for extortion, discrimination or targeted scams. Long after a hospital restores its systems, the information may still be circulating. Our article on how long data leaks can affect you explains why the risk window can stretch for years.

8. Timeline: after a hospital cyber incident

When	Action
Day 1	Verify the notice through official channels
Week 1	Freeze credit, change portal password, enable two-factor authentication
Week 2	Review explanations of benefits and statements
Month 1	Request records if concerned, remove public listings
Quarterly	Review insurance activity, re-check listings
Yearly	Review credit reports

9. Questions to ask your own provider

You are entitled to ask your doctor’s office or hospital how it protects your records. Reasonable questions include whether the patient portal supports two-factor authentication, how long records are retained, who they share data with and what happens if there is a cyber incident. You can also ask whether your information is stored with a third-party vendor, since many breaches begin with a supplier. Providers vary in how much they will say, but asking signals that patients care, and the answers help you decide how much to share and how closely to monitor.

10. Staying safe when systems go down

During an outage, patients sometimes receive calls from people claiming to restore appointments or collect payment. Treat all inbound requests for personal or payment information with suspicion. Use the phone number printed on a prior statement, a facility website you type in yourself or the insurance card in your wallet. If you take prescriptions, keep a list of medications and doses on paper or in your phone so that you can share it if electronic systems are unavailable. Keep copies of recent test results and care summaries that your portal lets you download. These small habits reduce disruption when a cyber incident strikes.

11. Where to learn more

The FBI’s Internet Crime Complaint Center publishes annual reports on cybercrime, including ransomware. The HHS Office for Civil Rights provides guidance on health privacy and breach reporting. Our own article on health data online explains where records travel once they leave a clinic.

12. Three scenarios and what to do

Scenario 1: A caller says they are from the hospital and asks you to confirm your insurance number. Hang up and call the facility using its official number.

Scenario 2: Your insurer lists a procedure you did not have. Contact the insurer and provider in writing, report possible medical identity theft and review your records.

Scenario 3: You receive an extortion email claiming to have your health records. Do not pay. Preserve the message and report it.

13. Myths and facts

Myth	Fact
Ransomware only affects computers, not patients	It can delay care and expose data
Hospitals always pay	Many do not, and payment does not ensure recovery
HIPAA means my data cannot be stolen	HIPAA sets rules; breaches still happen
Medical records are less valuable than cards	They are permanent and highly useful
Small hospitals are not targeted	Attackers go where defenses are weaker

14. Common mistakes

Ignoring breach notices.
Giving information to unsolicited callers.
Reusing the portal password.
Skipping explanation-of-benefits review.
Leaving credit unfrozen.
Assuming the incident is over when systems return.

15. Questions to ask yourself

Do I have two-factor authentication on my patient portal? Do I read my insurance statements? Could a stranger find my address, age and relatives online? Is my credit frozen? Address the weakest answer first.

16. How Wiperts fits

Health care breaches become more dangerous when criminals can fill in the missing details from public sources. Wiperts reduces that public side: it scans more than 100 data brokers and people-search sites, submits removal requests, removes personal results from Google and Bing, blurs your home on maps and monitors for returning profiles. Start with the free diagnosis.

100% Free Diagnosis: Check Your Exposure

Find out what data brokers have on you. Enter your details in the free scanner on the Wiperts homepage:

First Name
Last Name
Select State
Email Address
Website

Scan Databases Now — no payment is needed to see your exposure report.

17. Key takeaways

Ransomware disrupts care and can expose medical records.
Medical identity theft is hard to unwind, so review statements.
Freeze credit, secure portals and use your HIPAA rights.
Remove public listings that help criminals complete a profile.

Pick the Wiperts plan that fits your household

Plan	Covers	One-time deep scrub	Then
Individual	1 person	$89	$14/month
Couples (most popular)	2 people	$149	$24/month
Family	Up to 4 people	$199	$39/month

Every plan includes removal of your name, date of birth, salary, home address and phone number from 100+ data brokers and people-search sites, Google and Bing search-result removal, home blurring on maps, and 24/7 monitoring that re-removes your data if it reappears. See plans and start your removal

18. Frequently Asked Questions

What is ransomware?

Ransomware is malicious software that encrypts a victim’s files or systems and demands payment for the key to unlock them. Some attackers also steal data and threaten to publish it.

Why are hospitals targeted?

Hospitals depend on continuous access to systems, hold valuable personal and medical data and may run older technology, so attackers believe they are more likely to pay.

Is my medical information at risk in a ransomware attack?

It can be. Some attacks only lock systems, while others also copy records. The hospital’s notice should explain what was affected.

What is medical identity theft?

It happens when someone uses your identity to obtain care, prescriptions or insurance benefits, which can corrupt your records and create bills in your name.

What rights do I have under HIPAA?

You can request your records, ask for corrections and file a complaint if you believe your health information was mishandled. The HHS Office for Civil Rights explains these rights at hhs.gov/hipaa.

How can I protect myself after a hospital breach?

Review insurance statements, freeze your credit, change portal passwords, enable two-factor authentication and watch for phishing that cites the incident.

Sources

Ready to erase your footprint?

Stop letting data brokers profit from your personal life. Start your removal today.

Start Removing