Ransomware (extortion): Medical practice, USA 2019
On 10 August 2019, ransomware encrypted the practice’s servers, including the patient records.
- Incident · 08.2019 · California (Simi Valley), USA
- Evidence: confirmed by an authority
- Ransomware (extortion)
As of
What happened
The backup hard disks were also encrypted, so the data could not be restored. In September, the practice announced its final closure for 17 December 2019; according to the report to the US health authority, the incident affected 5'835 patients.
- Affected
- Wood Ranch Medical
- Industry
- Medical practice
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- yes / unknown
- Data affected
- true
- Bankruptcy
- no
- Entry point
- not stated in the sources
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Costs of getting data, software and systems running again
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Loss of income after an attack
Business interruption, only after the waiting period
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Letters, call centre, credit monitoring
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Proceedings before authorities
Costs of FDPIC or GDPR proceedings, usually not fines
Mostly limited 6 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Backups must be stored offline or immutably, and restoration must be tested regularly.
Sources
- California clinic to close after ransomware wipes out patient records (opens in a new window) Becker's Hospital Review · 2019-09
- Medical Practice Closing Permanently After Ransomware Attack (opens in a new window) SecurityWeek · 2019-09