Cyber Incident Victim: Campbell County Health
Date:
Sep 2019
Location:
United States of America
Summary
A ransomware attack targeted Campbell County Health, causing significant computer system disruptions and service outages. The facility's emergency department implemented triage protocols with potential patient transfers while other services remained temporarily unavailable. Critical care units including behavioral health, home health, hospice, and rehabilitation services maintained patient safety during the incident, with regional coordination for necessary transfers. Emergency medical services increased ambulance availability and the walk-in clinic operated under reduced hours. While operational impacts persisted without a restoration timeline, investigators found no evidence of patient data compromise during the ongoing criminal investigation into the sophisticated attack.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On September 20, 2019, at approximately 3:00 a.m., Campbell County Health in Gillette, Wyoming, experienced a ransomware attack that caused serious computer system disruptions. The attack immediately impacted hospital operations, triggering a service disruption across multiple departments. Initial emergency protocols required the Emergency Department and Walk-in Clinic to triage patients and transfer those needing advanced care to other facilities. All other hospital services suspended patient admissions at the onset of the incident. The Wyoming Department of Health alerted regional healthcare providers about the attack, confirming its criminal nature through a subsequent conference call with the Wyoming Office of Homeland Security.
By September 21 at 10:30 a.m., partial services had resumed under contingency measures. The Emergency Department reopened with physicians and nursing staff available for assessments, supplemented by additional Campbell County EMS ambulances. The Walk-in Clinic operated on reduced weekend hours from 8:00 a.m. to 6:00 p.m., accepting patients until 5:30 p.m. Hospital leadership confirmed that existing inpatients at Campbell County Memorial Hospital, Behavioral Health, Home Health and Hospice, and The Legacy Living and Rehabilitation Center remained under safe care, with transfers coordinated for patients requiring higher-acuity resources. Officials publicly acknowledged the ransomware’s sophistication and stated no evidence indicated patient data access or misuse, though investigations continued. Restoration timelines for full system functionality remained unspecified, with updates promised as recovery efforts progressed. Patient care prioritization and regional collaboration were emphasized throughout the response.