25th August 2025 Cyber Update: DaVita Dialysis Giant Hit by Interlock Ransomware Exposing 2.7 Million Records

Update: DaVita has disclosed that the Interlock ransomware gang successfully infiltrated its systems between March 24 and April 12, 2025, compromising the personal and medical information of nearly 2.7 million patients in what represents the second-largest healthcare cyberattack in the United States this year.

The breach primarily affected the company's laboratory operations and disrupted internal systems, forcing DaVita to implement immediate containment measures. The stolen data includes highly sensitive information such as patients' full names, Social Security numbers, dates of birth, health insurance details, comprehensive medical records, tax identification numbers, home addresses, and even images of checks made payable to the company. The Interlock ransomware group, which first emerged in September 2024, claimed responsibility for the attack on April 25, 2025, boasting that they had extracted approximately 1.5 terabytes of confidential data from DaVita's network infrastructure.

The cybercriminals have listed DaVita on their public leak site, where they typically pressure victims by threatening to sell or publicly release stolen files if ransom demands are not met. DaVita has not confirmed whether any ransom payment was made to the attackers, and the company has not disclosed the specific entry point used by the hackers or the size of any ransom demand. The healthcare giant is now offering affected patients free identity restoration services through Experian, with enrollment available until November 28, 2025.

Why it Matters: This massive healthcare breach demonstrates the escalating threat that ransomware groups pose to critical medical infrastructure worldwide, with implications extending far beyond US borders to countries like Australia where similar healthcare systems face identical vulnerabilities. The Interlock gang's sophisticated attack on DaVita reveals how cybercriminals are increasingly targeting healthcare providers due to their vast repositories of valuable personal and medical data, combined with their critical operational nature that makes them more likely to pay ransoms quickly.

This incident serves as a stark warning about the global nature of ransomware threats and the urgent need for enhanced cybersecurity measures in medical facilities. The breach affects not only direct patient care but also highlights the interconnected nature of modern healthcare systems, where data breaches can impact veteran care programs and international medical partnerships, potentially affecting Australian patients receiving treatment abroad or through international healthcare networks.