DaVita ransomware attack exposes 916,000 patient records and data

Healthcare institutions have become a favorite target for bad actors, largely because of how easy they make it for attackers. In June, researchers discovered a healthcare data breach that exposed the personal information of around 8 million patients. All of this information was publicly accessible online without any passwords or authentication protocols.

The latest healthcare organization to fall victim to a breach is DaVita, which has put nearly a million people at risk. Headquartered in Denver, Colorado, DaVita provides dialysis treatment to about 200,000 patients across the U.S. and 13 other countries.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM/NEWSLETTER

DIOR DATA BREACH EXPOSES US CUSTOMERS’ PERSONAL INFORMATION

What you need to know DaVita ransomware attack

Kidney dialysis giant DaVita says nearly 916,000 people had personal and medical information exposed in an April ransomware attack (via Comparitech). The breach, which the company disclosed in state filings, compromised names, Social Security numbers, dates of birth, health insurance details, medical records, tax ID numbers, addresses and even images of checks made out to the company.

DaVita says the incident disrupted internal operations and primarily affected its laboratories. In its latest notice to victims, the company says the cyberattack began March 24, 2025, and continued until April 12. It has not confirmed whether a ransom was paid.

Ransomware gang Interlock claimed responsibility on April 25, posting screenshots of alleged stolen documents and saying it took 1.5TB of DaVita’s data. The group lists the company on its public leak site, where it pressures victims by threatening to sell or release stolen files.

DaVita is offering eligible breach victims free identity restoration services through Experian, with a Nov. 28 enrollment deadline. The company has not confirmed how attackers gained access to its network or the size of the ransom demand.

CyberGuy reached out to DaVita for comment but did not receive a response before publication.

A healthcare professional working on a tablet   (Kurt “CyberGuy” Knutsson)

Who’s behind the DaVita breach

Interlock, which first appeared…