Claim details
Devman alleged theft of 120 GB and a $700,000 demand; FHW confirmation was not found and the hospital reported no evidence of data loss or encryption.
Family Health West cyberattack
Summary
Family Health West said it detected an attempted cyberattack Oct. 28, 2025, and took electronic systems offline while patient care continued through manual workflows. The hospital reported no evidence of data loss or encryption. Devman later claimed data theft and demanded $700,000, but FHW had not verified those claims.
Key facts
Timeline
-
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Operational impacts
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Healthcare operations disrupted
Clinical, diagnostic, pharmacy, patient-care, medical-record, or other healthcare operations were materially affected.
Extortion indicators
-
Leak-site listing
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
Incident narrative
Analyst assessment
Family Health West said it detected and contained an attempted cyberattack Oct. 28, 2025. Its IT team isolated electronic systems and began forensic review with outside specialists. DysruptionHub reported the precautionary shutdown and manual patient-care procedures the next day. The hospital said it had no evidence that patient or employee data was lost or encrypted. The original social post is currently unavailable, so these details are cross-checked against contemporaneous reporting.
Operational significance
Electronic systems at the Fruita hospital were taken offline as a precaution while staff continued patient care manually. FHW said bedside care continued. Its official primary-care page lists clinics in Fruita and Grand Junction, but the reviewed incident statements do not specify which individual clinics experienced downtime. Grand Junction is recorded as an organization location, not a confirmed clinic outage.
Extortion claim
Comparitech reported that Devman listed fhw.org and alleged theft of 120 GB, demanding $700,000 within four days. The indexed leak-site claim supports that a claim was made, but neither source verifies the theft or links Devman conclusively to the intrusion. FHW said it saw no evidence of data loss or encryption at the time of its statement. No payment or later data exposure was verified in the reviewed sources.
Status and gaps
FHW said it would restore systems methodically after checking that they were malware-free. An exact completion date, scope of any clinic-level disruption, technical cause and final data-impact determination were not found. Operational effects are presumed resolved because no continuing outage was found after more than 30 days; this is not an official all-clear.
Threat actor and claim
Organizations involved
Family Health West
Locations
Organization type
Critical infrastructure
Impacted locations
Fruita, Colorado
Hospital place anchor; electronic systems were isolated.
Grand Junction, Colorado
Family Health West operates a primary-care clinic in Grand Junction. This locates part of the affected organization; no clinic-specific outage is established.
Sources
FHW shut electronic systems Oct. 28 and continued patient care through manual procedures; no evidence of data loss or encryption.
Ransomware.live indexed a Devman leak-site claim for fhw.org with a 120 GB and $700,000 allegation.
FHW said it detected and contained an attempted attack, saw no evidence of data loss or encryption, isolated systems and restored them cautiously.
Devman alleged 120 GB stolen and demanded $700,000; FHW had not verified the claim.
FHW confirmed isolation and staged restoration; quoted IT director Derek Biddle.
FHW identifies itself as nonprofit and lists its Fruita hospital address and specialty-clinic network.
FHW lists primary care in Fruita and Grand Junction.
See something that needs correction?
Signed-in members can report an error, update, or missing source.