DaVita Ransomware Attack: 2.7 Million Patient Records Stolen by Interlock Gang in $13.5M Healthcare Breach

Breaking brief

Kidney dialysis giant DaVita confirmed one of 2025's largest healthcare breaches, with attackers stealing personal and medical data from approximately 2.7 million patients during a March‑April ransomware campaign. The Interlock cybercrime group claimed responsibility and leaked portions of stolen data after failed ransom negotiations, while DaVita faces $13.5 million in second‑quarter costs and multiple class‑action lawsuits.hipaajournal+1

Attack timeline and discovery

The breach window ran from March 24 to April 12, 2025, when DaVita detected and contained the intrusion targeting its laboratory database servers. Investigators found evidence that attackers accessed patient records, Social Security numbers, health insurance details, treatment information, and dialysis lab results across the company's network of over 2,600 outpatient centers.theregister+1

What data was compromised

Stolen information varied by individual but included names, addresses, birth dates, Social Security numbers, health insurance data, internal DaVita identifiers, clinical information such as health conditions and treatment details, certain dialysis lab test results, and in some cases tax identification numbers and images of checks written to DaVita.hipaanswers+1

Interlock ransomware gang profile

The Interlock group emerged in September 2024 as a financially motivated operation targeting critical infrastructure across North America and Europe, with a particular focus on healthcare organizations. The gang operates a data leak site called "Worldwide Secrets Blog" and claims to have exfiltrated over 20 terabytes of DaVita data, including what they describe as 200 million rows of patient information across SQL databases.hipaajournal+1

Healthcare sector targeting

Federal agencies issued warnings about Interlock specifically targeting healthcare after attacks on Texas Tech University Health Sciences Center, Kettering Health, and other medical facilities. The group's tactics include drive‑by downloads from compromised websites, ClickFix social engineering, and double‑extortion methods combining data theft with system encryption.aha+1

Financial and operational impact

DaVita reported $13.5 million in second‑quarter 2025 costs, including $12.5 million in administrative expenses for remediation, third‑party cybersecurity specialists, and system restoration, plus $1 million in increased patient care costs. The attack also negatively impacted billing, revenue collection, and patient census, with effects expected to influence treatment revenue throughout 2025.medtechdive+1

Legal consequences and lawsuits

Multiple class‑action lawsuits have been filed in federal court, including Reid v. DaVita Inc. and Jenkins et al v. DaVita, alleging inadequate data protection and delayed breach notification. Plaintiffs claim the stolen data is already being misused, though DaVita states it has received no reports of patient data misuse from the incident.thelyonfirm+1

HIPAA compliance implications

As a HIPAA‑covered entity, DaVita must comply with federal breach notification requirements and has begun notifying affected patients while offering 12‑24 months of free credit monitoring and identity theft protection. The Department of Health and Human Services has added the breach to its official reporting portal, and state attorneys general are reviewing compliance with privacy laws.hipaanswers+1

Patient notification and protection

DaVita is sending notification letters to affected individuals without explicitly mentioning ransomware but describing "unauthorized access to selected network servers." The company emphasizes that patient care was not disrupted during the attack and that all major impacted servers and systems have been restored.medtechdive+1

Healthcare cybersecurity crisis context

The DaVita attack represents the third‑largest healthcare breach reported in 2025, following Episource (5.5 million affected) and Blue Shield of California (4.7 million). Healthcare remains the most targeted sector for ransomware, with attacks affecting over half of all patients annually since 2020, reaching 69% in 2024 according to recent studies.jamanetwork+1

Detection and response lessons

Security experts emphasize the importance of proactive defense measures including regular penetration testing, employee training, third‑party audits, clear incident response protocols, and transparent reporting to reduce liability and reputational damage. The attack highlights vulnerabilities in healthcare IT infrastructure and the critical need for enhanced cybersecurity measures.deepstrike+1

By Alfaiz Nova expert commentary

Healthcare supply chain risks continue escalating as ransomware groups like Interlock exploit fundamental gaps in security controls. The DaVita incident demonstrates how attackers target laboratory systems containing concentrated patient data, while the $13.5 million cost reflects true breach economics beyond ransom payments. Organizations must prioritize behavior‑based detection over signature‑driven approaches, especially as polymorphic ransomware and AI‑generated variants evade traditional antivirus solutions.

Industry threat landscape analysis

The healthcare sector faces an average breach cost of $10.22 million in 2025, with sophisticated ransomware gangs shifting strategies to target vulnerable third‑party vendors and critical infrastructure. Interlock's emergence as a closed‑group operation departing from traditional ransomware‑as‑a‑service models indicates evolving threat actor sophistication and specialization in healthcare targeting.arcticwolf+1

by alfaiznova