Ransomware (extortion): Medical practice, USA 2019
Ransomware encrypted the patient records, appointment scheduling and billing of the two doctors’ practice; the perpetrators demanded 6'500 dollars.
- Incident · 03.2019 · Michigan (Battle Creek), USA
- Evidence: several media
- Ransomware (extortion)
As of
What happened
The doctors did not pay, whereupon the data was deleted; the backup copies were stored on site and were also lost. Instead of rebuilding the practice, both doctors took early retirement and closed the practice at the end of April 2019.
- Affected
- Brookside ENT and Hearing Center
- Industry
- Medical practice
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- yes / no
- Data affected
- true
- Bankruptcy
- no
- Entry point
- not stated in the sources
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Costs of getting data, software and systems running again
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Loss of income after an attack
Business interruption, only after the waiting period
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Help and negotiation; only some insurers pay the ransom, see note
Mostly add-on 6 of 9 business products cover it fully, as an add-on or with limits.
-
Third-party claims after a data breach
Liability for data protection and network security breaches
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Backups stored in the same network are lost along with everything else in a ransomware attack; a separate off-site copy is a must.
Sources
- Michigan medical practice to close after refusing to pay ransom to hackers (opens in a new window) Becker's Hospital Review · 2019-04
- Totaler Datenverlust durch Cyberangriff – Ausweg Praxisschliessung? (opens in a new window) Ärzte Zeitung · 2019-05-08