Wyoming
Table of Contents
- Identity Theft Statistics
- Top Ten Report Categories
- Top Identity Theft Types
- Fraud & Other Reports by Metropolitan Area
- Wyoming’s Recent Biggest Data Breaches
- What Should You Do if You Are in a Breach?
- Step-by-Step Process for Responding to a Data Breach
- Responsibilities of Companies that Have Been Breached
- Laws
- Resources
Data breaches occur when cybercriminals illegally access corporate or personal computer networks and view or steal personal data. They then use this information to extort money from their victims. The FBI reports that between 2020 and 2021, losses caused by cyber criminals doubled in Wyoming alone. That resulted from increased remote work in 2020 and the lack of awareness about the dangers of using poorly secured Wi-Fi networks for work purposes. The most common type of cyber crimes in Wyoming are investment scams, corporate data breaches, and ransomware scams.
Identity Theft Statistics
Reports
Reports
Losses
Top Ten Report Categories
Top Identity Theft Types
Wyoming's Recent Biggest Data Breaches
Change Health Care Data Breach
Change Healthcare is one of Wyoming's most prominent healthcare systems. The institution, a subsidiary of UnitedHealth Group, processes payments between providers and insurance corporations. It experienced a data breach in February 2024 that impacted the transmission of electronic attachments and claims. The hackers who implemented the breach refer to themselves as 'BlackCat'. They demanded $22 million from Change Healthcare to restore its data. Change Healthcare's personnel disconnected all compromised computer systems upon discovering the breach. The institution also paid the ransom before engaging federal officials to review patient privacy regulations and investigate the breach. Change Healthcare notified providers and patients about the breach after discovering it. Change Healthcare successfully isolated its compromised files and has engaged cybersecurity experts to prevent similar infiltrations in the future. The investigation into BlackCat's infiltration of the institution's IT network is still ongoing.
City of Rawlins Data Breach
In November 2023, the City of Rawlins experienced a data breach. The Wyoming Division of Criminal Investigation informed the City of Rawlins about a potential cyber breach of its computer servers. Though an unidentified hacker infiltrated the city's computer servers, no city services were interrupted. That is because the breach was swiftly discovered by local, state, and federal agencies, and any attempts to disrupt services were thwarted. The City of Rawlins' personnel notified their employees about the data breach and encouraged them to take steps to prevent such infiltrations in the future. The Cybersecurity and Infrastructure Security Agency gave guidance and linked the City of Rawlins with the Multi-State Information and Analysis Center, which assists cyberattack victims.
Data Breach in Eastern Wyoming College
On June 22, 2021, the Eastern Wyoming College suffered a data breach. The College's email, phone, and computer systems were disabled for 24 hours. The College's administrators engaged state cybersecurity professionals, Department of Homeland Security personnel, and law enforcement officials to investigate the cybersecurity attack and reinstate its network. The Eastern Wyoming College restored its computer network within days after the attack. Due to the data breach, the College recommended that its students alter their usernames and passwords to safeguard their personal information.
Wyoming Department of Health Data Breach
In 2020, the Wyoming Department of Health experienced a data breach that compromised the personal data of more than 165,000 Wyoming residents. On March 10, 2020, the Department discovered that an employee had inappropriately handled sensitive patient data, causing the unintentional exposure of more than 50 files containing COVID-19 test results. The employee mistakenly uploaded these files to public online storage repositories through GitHub servers. That made the data available to GitHub users who were not authorized to view it. The Wyoming Department of Health began to inform affected individuals about the data breach a few days after discovering it. The Department also advertised on its website that all persons who took COVID-19 tests between January and March 2020 should call its offices through a designated number to determine if their data was compromised. The Wyoming Department of Health has since hired independent cybersecurity specialists to improve the security measures applied to safeguard its network.
Data Breach in Cheyenne Regional Medical Center
In 2019, Wyoming's Cheyenne Regional Medical Center suffered a data breach. The health institution's payroll software was infiltrated by hackers using a phishing ransomware attack. That caused an outage that forced multiple departments at Cheyenne Regional Medical Center to manually input information so that their workers received their salaries on time. Some workers were underpaid, while others were overpaid. The data breach affected more than 2000 workers. The institution's executives swiftly moved to correct the problem, with underpaid workers being given their full salaries while overpaid workers were offered multiple payback options. The hackers compromised sensitive information such as the Cheyenne Regional employees' driver's license numbers, financial account information, and Social Security numbers. The institution hired independent cybersecurity specialists to investigate the data breach and safeguard its network. It also offered affected employees credit monitoring services for a limited period.
What Should You Do if You Are in a Breach?
Unfortunately, data breaches are pretty common now, considering our online connections and dependence on digital service delivery. Criminals work in the shadows to steal your personal information, so sometimes, it's only when you notice certain signs that ongoing fraud becomes apparent. These danger signs apply to both individuals and businesses.
Unfamiliar
Credit Card Charges
If you find unauthorized transactions on your credit card, there is a significant possibility your phone number, email address, or card number has been compromised.
Calls from
Debt Collectors
Phone calls or letters from collection agencies seeking debt payment for a loan you do not remember taking are also signs of identity theft.
New Credit Cards
or Loans in Your Name
A new line of credit in your name or a loan taken is a warning sign you are a victim of identity theft.
Surprise Credit
Score Drops
Sudden credit drops with no obvious cause are a sign of suspicious activities.
Unusual Activity on Your
Social Security Account
The federal government also considers social security numbers personal identifiers, so check your social security statement regularly to ensure no one has access to benefits without consent.
Inability to
Sign-in to Accounts
If you are locked out of the account, it is usually because someone has hacked into it and changed the password. You should immediately try all possible recovery options and contact customer support if all fails.
Step-by-Step Process for Responding to a Data Breach
Contact Local Law Enforcement
As an individual or a business, report the incident to the police and file a police report.
Assess and Secure Compromised Areas
Identify which aspects of your information have been affected, such as emails, passwords, credit card numbers, social security numbers, full names, and phone numbers.
Contain the Breach
Isolate the affected system to prevent further damage.
Create New, Strong Passwords for All Accounts
This may involve changing usernames and passwords for compromised platforms, using strong passwords with a mix of upper and lower-case letters, digits, and special characters.
Notify Affected Institutions
Inform your bank, credit card companies, and other affected institutions. Request they close or freeze any accounts that may be implicated in the breach to reduce financial risk.
Update Security on Digital Accounts
Change passwords for all accounts affected by the breach. Make sure each password is totally unique, and you use two-factor verification as an additional layer of security.
Check for Malware
Examine your computers and mobile devices for installed malware. Install robust antivirus software to detect and remove any viruses or malicious software.
Freeze Your Credit
In cases of identity theft, contact all credit bureaus to freeze your credit.
Monitor Your Mail and Credit Reports
Keep an eye out for any unauthorized changes in your mail.
Engage Legal Assistance When Applicable
If you are a business, consider hiring a law firm experienced in handling data breaches.
Responsibilities of Companies that Have Been Breached
Wyoming State regulations mandate that business organizations within Wyoming inform their clients of data breaches within 60 days of the incident. In Wyoming, personal information protected by data breach laws includes driver's license numbers, unique biometric data, electronic or digitized signatures, security tokens, Social Security numbers, birth certificates, tribal identification cards, health insurance data, debit and credit card account numbers, date of birth, email addresses, and passwords. Cyber security attacks that must be reported include Denial of Service (DoS) attacks, malware incidents, the use of ransomware, and identity theft incidents. Business organizations may delay informing customers about data breaches if that action interferes with ongoing criminal investigations. Additionally, businesses are expected to notify affected clients about data breaches by written or electronic notice. Organizations may use substitute notices like statewide media or their website to inform clients of data breaches if using electronic or written notice exceeds $10,000. If an organization fails to follow these regulations in the event of a data breach, Wyoming's Attorney General may bring an action in law.
Laws
- Wyo. Stat. §§ 40- 12-501 -502 establishes the regulations that organizations and business entrepreneurs in Wyoming must follow when they experience a data breach. This statute specifies what data is legally protected as personal information by Wyoming law. Based on this law, business entities in Wyoming may provide substitute breach notifications to customers or clients under specific circumstances. These circumstances include when the cost of issuing data breach notifications surpasses $10,000 or when the entity does not have adequate contact information to provide clients with standard notifications. Under this Statute, Wyoming's Attorney General may impose legal sanctions on business entities or entrepreneurs who do not adhere to these laws.