Brinztech Cyber News: DaVita Confirms Ransomware Attack Exposed Health Data of 2.7 Million People

Key Takeaways

• Kidney dialysis provider DaVita has confirmed a major data breach affecting nearly 2.7 million individuals.
• The incident was a ransomware attack, with the Interlock gang claiming responsibility and leaking the data in April after failed negotiations.
• The stolen data is highly sensitive, including Social Security Numbers, medical diagnoses, lab results, and health insurance information.
• The attackers were inside DaVita’s network for nearly three weeks, from March 24 to April 12, 2025.
• DaVita is notifying all affected current and former patients and offering complimentary credit monitoring services.

DaVita Confirms Massive Health Data Breach

What Happened? DaVita, a leading global provider of kidney dialysis services, has officially confirmed the scale of a data breach that resulted from a ransomware attack earlier this year. According to the U.S. Department of Health’s breach portal, the incident has impacted a total of 2,689,826 people, though DaVita has reportedly revised this number down to 2.4 million in its ongoing investigation.

The breach is a result of a cyberattack where intruders had access to DaVita’s network for nearly three weeks, from March 24 until the company detected and evicted them on April 12.

What Data Was Stolen? During their time in the network, the attackers stole a vast amount of highly sensitive patient information from the company’s dialysis labs database. This is a critical breach of Protected Health Information (PHI). The compromised data includes a combination of:

• Personal Data: Full names, addresses, dates of birth, and Social Security Numbers.
• Health Insurance Data: Information related to patients’ insurance coverage.
• Protected Health Information (PHI): Medical conditions, treatment information, and dialysis lab test results.
• Other Financial Data: For some individuals, the stolen data also included tax identification numbers and, in some cases, images of personal checks.

Interlock Ransomware Gang Claims Responsibility in Double Extortion Attack

While DaVita has not publicly named the threat actor, the Interlock ransomware gang claimed responsibility for the attack in late April. In a classic “double extortion” tactic, the gang leaked approximately 1.5 terabytes of data on their dark web portal after ransom negotiations with DaVita allegedly failed.

Interlock is a relatively new but aggressive ransomware operation that emerged in September 2024 and has shown a specific focus on targeting healthcare organizations worldwide. The group has also recently been linked to an attack on the healthcare giant Kettering Health.

DaVita is now in the process of notifying all current and former patients affected by the breach and is providing them with complimentary credit monitoring to help safeguard their data.

Key Cybersecurity Implications

• A Critical Breach of Protected Health Information (PHI): The exposure of detailed medical and treatment information is a profound violation of patient privacy. This data can be used by criminals for highly targeted and cruel scams, complex insurance fraud, and blackmail. This is a major HIPAA breach that will result in severe regulatory consequences.
• The Danger of Long Dwell Times: The attackers were inside DaVita’s network for 19 days before being detected. This long “dwell time” gave them ample opportunity to move laterally, escalate privileges, and exfiltrate a massive amount of data (1.5 TB) before finally deploying their ransomware to encrypt systems. This highlights the critical importance of early detection and response capabilities.
• Healthcare Remains a Top Target for Ransomware: Interlock’s focus on DaVita and Kettering Health underscores that the healthcare sector remains a prime target for ransomware gangs. Attackers know that the critical nature of patient care and the sensitivity of the data create immense pressure on these organizations to pay ransoms to restore services and prevent data leaks.

Secure Your Organization with Brinztech As a cybersecurity provider, we can protect your business from the threats discussed here. Contact us to learn more about our services.

Questions or Feedback? For expert advice, use our ‘Ask an Analyst’ feature. For general inquiries or to report this post, please email us: contact@brinztech.com