Kettering Health has provided an update on its May 20, 2025, ransomware attack. The investigation confirmed that the Interlock ransomware group first gained access to its network on April 9, 2025, and retained access until May 20, 2025, when the attack was detected and the unauthorized access was blocked. During that time, the ransomware group accessed or copied files containing patient information.

Kettering Health has been providing regular updates on its progress recovering from the attack and has now completed its file review. The review confirmed that current and former patients had the following information compromised in the attack: first and last name, contact information, date of birth, Social Security number, patient identification number, medical record number, medical information, treatment information, diagnosis information, health insurance information, driver’s license/state identification number, financial account information, and/or education records.

Kettering Health said it has reviewed its policies, procedures, and processes related to data security and has taken steps to prevent similar incidents in the future. Kettering Health said it is unaware of any misuse of the exposed information and has provided patients with information on how they can protect themselves against identity theft and fraud. Complimentary credit monitoring and identity theft protection services do not appear to have been offered.

The data breach was reported to the HHS’ Office for Civil Rights on July 21, 2025, using a placeholder estimate of at least 501 affected individuals. The total has not yet been updated, so it is still unclear how many individuals have been affected.

June 13, 2025: Kettering Health Resumes Normal Operations for Key Services Following Ransomware Attack

It has taken three weeks, but Kettering Health has confirmed that it has resumed normal operations for key services following its May 20, 2025, Interlock ransomware attack. Kettering Health has been releasing regular updates on the progress being made restoring its systems, confirming that the core components of its Epic EHR system were restored on the morning on June 2, 2025, which allowed patient data to be entered, and the backlog of data recorded on paper to start to be entered into patient records.

Interlock’s access to its network and system was immediately terminated when the attack was discovered, and Kettering Health confirmed on June 5, 2025, that all of the ransomware group’s tools and persistence mechanisms had been eradicated from its systems. Kettering Health also confirmed that all systems were fully up to date with the latest versions of software installed and patches applied, and security enhancements had been implemented, including network segmentation, enhanced monitoring, and updated access controls. Kettering Health said it is confident that its cybersecurity framework and employee security training are sufficient to mitigate future risks.

The primary purpose throughout the incident response has been to ensure quality care was still provided to patients while ensuring that all network-connected devices were secure and connections with its partners were fully protected. Kettering Health stated the main focus has now shifted from securing systems to ensuring that patient communication systems and scheduling systems are fully restored.

On June 9, 2025, Kettering Health confirmed that MyChart access for patients had been restored in a limited capacity and patients could view their upcoming appointments, schedule appointments, view prescriptions and fill refills, view test results, and message providers. All surgeries had also resumed. On June 10, 2025, Kettering Health announced that normal operations had been resumed for several key services, including surgery, imaging, retail pharmacy, and physician office visits. MyChart access had been fully restored, and its phone lines were functional and stable.

The recovery process continues to restore further systems, and the data analysis is progressing to determine the extent of data theft. No estimate has been provided so far on the number of individuals affected, only a placeholder of 501 individuals registered with the HHS’ Office for Civil Rights. Individual notification letters will be mailed to the affected individuals as soon as possible, including information about credit monitoring and fraud protection services.

June 5, 2025: Kettering Health Ransomware Attack: Interlock Ransomware Group Leaks Stolen Data

Kettering Health is continuing to make progress in recovering from its May 20, 2025, ransomware attack. While its EHR has been restored, other IT systems remain offline, with disruption continuing at its Ohio medical centers and outpatient facilities. Earlier this week, Kettering Health issued an update confirming that a small subset of patient data was stolen in the attack, although the extent of the data breach has yet to be confirmed.

Kettering Health has not named the ransomware group behind the incident, although CNN claimed to have viewed a copy of a ransom note indicating the Interlock ransomware group was responsible. This week, Interlock claimed responsibility for the attack and added Kettering Health to its dark web data leak site and listed the stolen data for download, indicating the ransom was not paid.

The Interlock claims to have stolen 941 GB of data from Kettering Health before ransomware was used to encrypt files. The stolen data includes 732,490 files spread across 20,418 folders. The HIPAA Journal has not downloaded any of the data, so it cannot confirm the extent to which patient and employee data has been compromised. Based on the folder and file names, the stolen data appears to include payroll information, employee files, scans of identity documents, police security personnel files, Medicaid application documents, pharmacy and blood bank documents, financial revenue reports, corporate insurance files, corporate tax information, budget reports, and patient files.

June 3, 2025: Kettering Health Restores EHR After Ransomware Attack

Kettering Health said it restored the core components of its Epic electronic health record (EHR) system on the morning of June 2, 2025, and it is now possible to enter patient information directly into electronic health records. Patient information that was recorded manually during the outage can now be added to patients’ digital health records. The restoration of the EHR will allow care teams to communicate more effectively and coordinate patient care with greater speed and clarity.

Kettering Health said more than 200 people from its information systems team, clinical team, and the software company Epic have been working around the clock over the past two weeks to get to this point. “This marks a major milestone in our broader restoration efforts and a vital step toward returning to normal operations,” explained Kettering Health. The restoration of other IT systems is continuing, including its MyChart patient portal and its inbound and outbound phone lines. Kettering Health has confirmed that its emergency departments are no longer on diversion, and its primary care locations are providing walk-in care to established patients.  Kettering Health CEO Michael Gentry has also confirmed that there has been unauthorized access to the data of “a small subset” of Kettering Health patients. The investigation into the data breach is ongoing, and notification letters will be mailed to the affected individuals when the investigation is concluded.

On May 30, 2025, Kettering Health provided an update to its staff, partners, and community members about scam communications, which may include phone calls, text messages, and emails. Gentry explained that these communications are “designed to intimidate, demand a response, or claim data exposure.” Gentry advised the public to exercise caution, not to click any links, open attachments, or respond to the communications, and if contacted by phone about the cyberattack, to hang up immediately. Any malicious or suspicious communications should be reported to the police.

May 21, 2025: Ransomware Attack Causes System-wide Outage at Kettering Health

Kettering Health, a large health system with 14 medical centers and 120 outpatient facilities in western Ohio, has experienced “a system-wide technology outage” that has affected all 14 of its medical centers and disrupted its call center. The outage occurred on the morning of Tuesday, May 20, 2025, and without access to critical IT systems, the decision was taken to cancel scheduled inpatient and outpatient procedures on Tuesday.

The medical centers remain open, and emergency rooms are continuing to accept patients. The staff is working on established downtime procedures and reverting to pen and paper to record patient information while IT systems are offline. The IT team is working around the clock to investigate the incident and bring systems back online safely and securely.  “We have procedures and plans in place for these types of situations and will continue to provide safe, high-quality care for patients currently in our facilities,” explained Kettering Health in a website announcement.

According to CNN, which obtained a copy of a ransom note, this was a ransomware attack by the Interlock ransomware group, a threat group with a history of double extortion attacks on the healthcare sector. The Interlock ransomware group breaches networks, identifies data of interest, exfiltrates files, and uses ransomware to encrypt files. The ransom must be paid to prevent the publication of the stolen data on its dark web data leak site and to obtain the keys to decrypt the data. Interlock was behind the recent ransomware attack on the kidney dialysis service giant Davita, Brockton Neighborhood Health Center in Massachusetts, the Drug and Alcohol Treatment Service in Pennsylvania, and Texas Tech University Health Sciences Center.

“Since it first emerged back in October 2024, we’ve tracked 16 confirmed attacks via this group, while a further 17 remain unconfirmed by the victims involved. Today, Interlock also came forward to claim a large-scale attack on West Lothian Council, UK, which has been disrupting its school network for over a week,” Rebecca Moody, Head of Data Research at Comparitech, told The HIPAA Journal. “While this attack on Kettering Health is in its early stages, it’s highly likely Interlock will have stolen data and will release this if its ransom demands aren’t met.”

The investigation is still in the early stages, and Kettering Health is not yet in a position to state to what extent, if any, patient data has been stolen. The healthcare system confirmed that the outage was caused by a cyberattack, but has not verified that this was a ransomware attack. The Interlock ransomware group claims to have “secured your most vital files” and has threatened to publish the stolen data if Kettering Health refuses to negotiate payment.

Within a few hours of the announcement, Kettering Health issued a warning about scam calls. “We have confirmed reports that scam calls have occurred from persons claiming to be Kettering Health team members requesting credit card payments for medical expenses,” explained Kettering Health. “While it is customary for Kettering Health to contact patients by phone to discuss payment options for medical bills, out of an abundance of caution, we will not be making calls to ask for or receive payment over the phone until further notice.”

This post will be updated as further information becomes available.

The post Kettering Health Confirmed Patient Data Compromised in May 2025 Ransomware Attack appeared first on The HIPAA Journal.