Episource LLC, a provider of medical coding, risk adjustment services, and software solutions for healthcare providers and health plans, has experienced a cyberattack involving the theft of customer data. A network intrusion was detected on February 6, 2025, after suspicious activity had been identified within its network. All computer systems were powered down to prevent further unauthorized access, law enforcement was notified, and third-party cybersecurity experts were engaged to assist with the investigation and determine the nature and scope of the unauthorized activity.

The forensic investigation confirmed there had been unauthorized access to its computer systems between January 27, 2025, and February 6, 2025. The California Attorney General was notified about the breach on June 6, 2025, and at that time, Episource said it was unaware of any misuse of the compromised data. Individual notification letters have been issued on a rolling basis since April 23, 2025.

The review of the compromised files confirmed that they contained a range of data, which varied from individual to individual. Potentially compromised data included names and contact information (address, phone number, and email address), together with one or more of the following:

• Health information: diagnosis information, treatment information, prescriptions, test results, medical images, medical record numbers, and doctors’ names.
• Health plan information: health plan policies, company names, member/group ID numbers, and Medicaid/Medicare payor ID numbers
• Other personal information, such as date of birth

Episource said it is strengthening system security to prevent similar breaches in the future, and that the affected individuals are being offered two years of complimentary credit monitoring and identity theft protection services. Episource did not disclose the nature of the attack in its notification letters; however, this appears to be a ransomware attack. The group responsible is currently unknown.

Sharp Community Medical Group and Sharp HealthCare have confirmed that they have been affected by the incident, but it is currently unclear how many other clients have been impacted. The number of affected individuals is also currently unknown, as the data breach is not yet displayed on the OCR breach portal.

The post Episource Ransomware Attack Affects Multiple Healthcare Customers appeared first on The HIPAA Journal.

Dozens of lawsuits have been filed against Kettering Health in response to a 2025 ransomware attack involving data theft and delays to medical care. The HIPAA Journal covered the ransomware attack and data breach last year (see below) after the initial announcement in May 2025. It has been 10 months since the attack occurred, and the number of affected individuals has yet to be confirmed. The HHS’ Office for Civil Rights data breach portal still lists the incident with the initial placeholder estimate of 500 affected individuals.

The Interlock ransomware group claimed it had stolen 941 GB of data and encrypted files, then published the stolen data when the ransom was not paid. Kettering Health was forced to shut down around 600 digital applications, and employees switched to pen and paper to record patient information. The attack occurred on May 20, 2025, and Kettering Health was forced to cancel appointments while it restored its systems. It took until June 2, 2025, for its Epic electronic medical record system to be restored, and a further week for normal operations to resume. Kettering Health said normal operations resumed on June 10, 2025.

While class action lawsuits are now inevitable following any healthcare data breach due to the exposure or theft of personal and protected health information, in this case, many lawsuits have been filed over alleged delays to medical care, and in some cases, denial of care. According to the Vandalia, Ohio-based law firm Wright & Schulte LLC, which is representing many of the affected patients, 44 individual lawsuits against Kettering Health have been consolidated in a single complaint in the Montgomery County Common Pleas Court in Ohio. Out of those 44 lawsuits, 37 allege Kettering Health delayed treatment, and 8 allege denial of care. While the attack resulted in systems being taken offline for around 3 weeks, the delays to treatment were more extensive. Some patients participating in the litigation claim their appointments were rescheduled months later, some experienced prescription delays, and others claim that their appointments have not been rescheduled at all.

The lawyers allege that there was no contingency plan for a ransomware attack, and Kettering Health “just stopped seeing patients, stopped taking phone calls, and they started turning everybody away.” Some of the patients were receiving cancer treatments and other critical care, and were left without access to essential medications.

The consolidated lawsuit asserts claims of negligence, gross negligence, emotional distress, and breach of contract. The plaintiffs are seeking damages in excess of $25,000, as well as punitive damages, and attorneys’ fees and legal expenses. In addition to compensation for the injuries sustained as a result of the attack, the plaintiffs also want to ensure that Kettering Health makes the necessary improvements to security to prevent similar incidents in the future.

October 17, 2025: Kettering Health Confirms Patient Data Compromised in May 2025 Ransomware Attack

Kettering Health has provided an update on its May 20, 2025, ransomware attack. The investigation confirmed that the Interlock ransomware group first gained access to its network on April 9, 2025, and retained access until May 20, 2025, when the attack was detected, and the unauthorized access was blocked. During that time, the ransomware group accessed or copied files containing patient information.

Kettering Health has been providing regular updates on its progress recovering from the attack and has now completed its file review. The review confirmed that current and former patients had the following information compromised in the attack: first and last name, contact information, date of birth, Social Security number, patient identification number, medical record number, medical information, treatment information, diagnosis information, health insurance information, driver’s license/state identification number, financial account information, and/or education records.

Kettering Health said it has reviewed its policies, procedures, and processes related to data security and has taken steps to prevent similar incidents in the future. Kettering Health said it is unaware of any misuse of the exposed information and has provided patients with information on how they can protect themselves against identity theft and fraud. Complimentary credit monitoring and identity theft protection services do not appear to have been offered.

The data breach was reported to the HHS’ Office for Civil Rights on July 21, 2025, using a placeholder estimate of at least 501 affected individuals. The total has not yet been updated, so it is still unclear how many individuals have been affected.

June 13, 2025: Kettering Health Resumes Normal Operations for Key Services Following Ransomware Attack

It has taken three weeks, but Kettering Health has confirmed that it has resumed normal operations for key services following its May 20, 2025, Interlock ransomware attack. Kettering Health has been releasing regular updates on the progress being made restoring its systems, confirming that the core components of its Epic EHR system were restored on the morning of June 2, 2025, which allowed patient data to be entered, and the backlog of data recorded on paper to start to be entered into patient records.

Interlock’s access to its network and system was immediately terminated when the attack was discovered, and Kettering Health confirmed on June 5, 2025, that all of the ransomware group’s tools and persistence mechanisms had been eradicated from its systems. Kettering Health also confirmed that all systems were fully up to date with the latest versions of software installed and patches applied, and security enhancements had been implemented, including network segmentation, enhanced monitoring, and updated access controls. Kettering Health said it is confident that its cybersecurity framework and employee security training are sufficient to mitigate future risks.

The primary purpose throughout the incident response has been to ensure quality care was still provided to patients while ensuring that all network-connected devices were secure and connections with its partners were fully protected. Kettering Health stated the main focus has now shifted from securing systems to ensuring that patient communication systems and scheduling systems are fully restored.

On June 9, 2025, Kettering Health confirmed that MyChart access for patients had been restored in a limited capacity and patients could view their upcoming appointments, schedule appointments, view prescriptions and fill refills, view test results, and message providers. All surgeries had also resumed. On June 10, 2025, Kettering Health announced that normal operations had been resumed for several key services, including surgery, imaging, retail pharmacy, and physician office visits. MyChart access had been fully restored, and its phone lines were functional and stable.

The recovery process continues to restore further systems, and the data analysis is progressing to determine the extent of data theft. No estimate has been provided so far on the number of individuals affected, only a placeholder of 501 individuals registered with the HHS’ Office for Civil Rights. Individual notification letters will be mailed to the affected individuals as soon as possible, including information about credit monitoring and fraud protection services.

June 5, 2025: Kettering Health Ransomware Attack: Interlock Ransomware Group Leaks Stolen Data

Kettering Health is continuing to make progress in recovering from its May 20, 2025, ransomware attack. While its EHR has been restored, other IT systems remain offline, with disruption continuing at its Ohio medical centers and outpatient facilities. Earlier this week, Kettering Health issued an update confirming that a small subset of patient data was stolen in the attack, although the extent of the data breach has yet to be confirmed.

Kettering Health has not named the ransomware group behind the incident, although CNN claimed to have viewed a copy of a ransom note indicating the Interlock ransomware group was responsible. This week, Interlock claimed responsibility for the attack and added Kettering Health to its dark web data leak site and listed the stolen data for download, indicating the ransom was not paid.

The Interlock claims to have stolen 941 GB of data from Kettering Health before ransomware was used to encrypt files. The stolen data includes 732,490 files spread across 20,418 folders. The HIPAA Journal has not downloaded any of the data, so it cannot confirm the extent to which patient and employee data has been compromised. Based on the folder and file names, the stolen data appears to include payroll information, employee files, scans of identity documents, police security personnel files, Medicaid application documents, pharmacy and blood bank documents, financial revenue reports, corporate insurance files, corporate tax information, budget reports, and patient files.

June 3, 2025: Kettering Health Restores EHR After Ransomware Attack

Kettering Health said it restored the core components of its Epic electronic health record (EHR) system on the morning of June 2, 2025, and it is now possible to enter patient information directly into electronic health records. Patient information that was recorded manually during the outage can now be added to patients’ digital health records. The restoration of the EHR will allow care teams to communicate more effectively and coordinate patient care with greater speed and clarity.

Kettering Health said more than 200 people from its information systems team, clinical team, and the software company Epic have been working around the clock over the past two weeks to get to this point. “This marks a major milestone in our broader restoration efforts and a vital step toward returning to normal operations,” explained Kettering Health. The restoration of other IT systems is continuing, including its MyChart patient portal and its inbound and outbound phone lines. Kettering Health has confirmed that its emergency departments are no longer on diversion, and its primary care locations are providing walk-in care to established patients.  Kettering Health CEO Michael Gentry has also confirmed that there has been unauthorized access to the data of “a small subset” of Kettering Health patients. The investigation into the data breach is ongoing, and notification letters will be mailed to the affected individuals when the investigation is concluded.

On May 30, 2025, Kettering Health provided an update to its staff, partners, and community members about scam communications, which may include phone calls, text messages, and emails. Gentry explained that these communications are “designed to intimidate, demand a response, or claim data exposure.” Gentry advised the public to exercise caution, not to click any links, open attachments, or respond to the communications, and if contacted by phone about the cyberattack, to hang up immediately. Any malicious or suspicious communications should be reported to the police.

May 21, 2025: Ransomware Attack Causes System-wide Outage at Kettering Health

Kettering Adventist Healthcare (Kettering Health), a large health system with 14 medical centers and 120 outpatient facilities in western Ohio, has experienced “a system-wide technology outage” that has affected all 14 of its medical centers and disrupted its call center. The outage occurred on the morning of Tuesday, May 20, 2025, and without access to critical IT systems, the decision was taken to cancel scheduled inpatient and outpatient procedures on Tuesday.

The medical centers remain open, and emergency rooms are continuing to accept patients. The staff is working on established downtime procedures and reverting to pen and paper to record patient information while IT systems are offline. The IT team is working around the clock to investigate the incident and bring systems back online safely and securely.  “We have procedures and plans in place for these types of situations and will continue to provide safe, high-quality care for patients currently in our facilities,” explained Kettering Health in a website announcement.

According to CNN, which obtained a copy of a ransom note, this was a ransomware attack by the Interlock ransomware group, a threat group with a history of double extortion attacks on the healthcare sector. The Interlock ransomware group breaches networks, identifies data of interest, exfiltrates files, and uses ransomware to encrypt files. The ransom must be paid to prevent the publication of the stolen data on its dark web data leak site and to obtain the keys to decrypt the data. Interlock was behind the recent ransomware attack on the kidney dialysis service giant Davita, Brockton Neighborhood Health Center in Massachusetts, the Drug and Alcohol Treatment Service in Pennsylvania, and Texas Tech University Health Sciences Center.

“Since it first emerged back in October 2024, we’ve tracked 16 confirmed attacks via this group, while a further 17 remain unconfirmed by the victims involved. Today, Interlock also came forward to claim a large-scale attack on West Lothian Council, UK, which has been disrupting its school network for over a week,” Rebecca Moody, Head of Data Research at Comparitech, told The HIPAA Journal. “While this attack on Kettering Health is in its early stages, it’s highly likely Interlock will have stolen data and will release this if its ransom demands aren’t met.”

The investigation is still in the early stages, and Kettering Health is not yet in a position to state to what extent, if any, patient data has been stolen. The healthcare system confirmed that the outage was caused by a cyberattack, but has not verified that this was a ransomware attack. The Interlock ransomware group claims to have “secured your most vital files” and has threatened to publish the stolen data if Kettering Health refuses to negotiate payment.

Within a few hours of the announcement, Kettering Health issued a warning about scam calls. “We have confirmed reports that scam calls have occurred from persons claiming to be Kettering Health team members requesting credit card payments for medical expenses,” explained Kettering Health. “While it is customary for Kettering Health to contact patients by phone to discuss payment options for medical bills, out of an abundance of caution, we will not be making calls to ask for or receive payment over the phone until further notice.”

This post will be updated as further information becomes available.

The post Dozens of Lawsuits Filed in Response to Kettering Health Ransomware Attack appeared first on The HIPAA Journal.