Interlock ransomware gang started leaking data allegedly stolen from leading kidney dialysis firm DaVita

The Interlock ransomware gang claimed responsibility for the attack on the leading kidney dialysis company DaVita and leaked alleged stolen data.

DaVita Inc. provides kidney dialysis services through a network of 2,675 outpatient centers in the United States, serving 200,800 patients, and 367 outpatient centers in 11 other countries, serving 49,400 patients. DaVita specializes in treating end-stage renal disease (ESRD), requiring patients to undergo dialysis three times a week unless they receive a kidney transplant. The company holds a 37% share of the U.S. dialysis market and is headquartered in Denver, though incorporated in Delaware.

The company is ranked 341st on the Fortune 500.

On April 18, 2025, the company announced it is currently investigating and addressing a recent cybersecurity incident that has temporarily disrupted certain internal operations.

DaVita is prioritizing continuity of in-patient dialysis care following a cyberattack. They’ve activated contingency plans and manual procedures where necessary and are working to securely restore affected systems.

“On April 12, 2025, DaVita became aware of a ransomware incident affecting and encrypting certain on-premises systems. We activated our incident response protocols and implemented containment measures, including proactively disconnecting parts of the network.

External cybersecurity experts are assisting with our response, remediation and recovery efforts, and we are in the process of rebuilding and restoring encrypted systems and bringing them back online in a secure manner.” states the company. “While the incident has resulted in disruption to our internal operations, we continue to have contingency plans and manual processes in place where needed with a focus on continuity of patient care.”

The Interlock ransomware gang has claimed responsibility for the cyberattack on DaVita.

The group claimed the theft of 1510 GB of sensitive data, including patient records, insurance, and financial information. Interlock leaked DaVita’s alleged stolen files on their data leak site.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, DaVita)