DaVita Patient Data of 2.7 Million Exposed in Cascading Ransomware Supply Chain Attack

In a stark illustration of healthcare’s third-party vulnerability, a ransomware attack exploiting the pervasive MOVEit Transfer vulnerability has compromised the protected health information (PHI) of nearly 2.7 million patients of DaVita Inc., a leading U.S. kidney care provider. The breach, originating not within DaVita's own infrastructure but at its communications vendor Welltok, Inc., underscores the systemic risk posed by software supply chains and the enduring threat from the Clop ransomware group’s 2023 campaign.

A Third-Party Conduit

DaVita, which operates a network of over 2,800 dialysis facilities and serves approximately 244,000 patients, was not directly compromised. Instead, the breach vector was its third-party service provider, Welltok, Inc., which delivers patient engagement and communication software to numerous healthcare entities.

The incident is a direct consequence of the mass-exploitation of zero-day vulnerabilities (CVE-2023-34362, CVE-2023-35036) in Progress Software’s MOVEit Transfer secure file-transfer tool in May 2023. Welltok utilized this platform, and its systems were breached during the wide-scale campaign orchestrated by the Clop (aka Cl0p) ransomware gang. The data pertaining to DaVita’s patients, exfiltrated during that event, has now been leveraged by a second threat actor, RansomHub, which is reportedly monetizing the previously stolen dataset.

MOVEit Legacy Monetization

The attack pathway demonstrates a classic software supply chain compromise:

Initial Exploitation: In May 2023, Clop actors systematically identified and attacked internet-facing MOVEit Transfer servers, including one belonging to Welltok, using a SQL injection vulnerability to gain unauthorized access.

Data Exfiltration: The threat actors harvested files containing sensitive data from Welltok’s system. Welltok served as a central data processor for its clients, meaning a single breach exposed data across its entire customer base.

Secondary Data Sale: Recent analysis indicates that the data stolen from Welltok, including the DaVita patient information, has been acquired or is being threatened by RansomHub. This group operates a ransomware-as-a-service (RaaS) model and frequently employs double-extortion tactics, encrypting data and threatening to publish it. In this case, they are likely pressuring victims by threatening to release the data originally stolen by Clop, highlighting an evolving trend of data "trading" or "resale" within the cybercriminal ecosystem.

A High-Value Payload

The exposed data constitutes a high-value payload for cybercriminals due to its comprehensiveness and sensitivity, which facilitates identity theft, targeted phishing (smishing/vishing), and insurance fraud. According to filings and notifications, the compromised information includes:

Personally Identifiable Information (PII): Full names, Social Security Numbers (SSNs), and contact information.
Protected Health Information (PHI): Health insurance details, medical diagnoses, procedures, and medications.

The combination of SSNs and specific medical records creates a potent risk for affected individuals, as this information is perennial on dark web markets and is not easily changed, unlike a compromised credit card number.

A Delayed Disclosure

Welltok, as the data processor, began notifying affected organizations and individuals in April 2024, nearly a year after the initial intrusion. This delay is attributed to the complex process of identifying, categorizing, and validating the impacted data across its vast client portfolio.

DaVita reported the breach to the U.S. Department of Health and Human Services (HHS) as required by the Health Insurance Portability and Accountability Act (HIPAA). The incident is listed on the HHS breach portal as impacting 2,700,000 individuals.

In compliance with standard post-breach protocols, Welltok is offering affected individuals 24 months of complimentary credit monitoring and identity theft protection services through CyEx.

A Systemic Healthcare Vulnerability

The DaVita/Welltok incident is not an outlier but a critical node in one of the most significant cyber campaigns in recent history. The MOVEit exploitation campaign has impacted over 2,700 organizations and 90 million individuals globally, spanning finance, energy, and most acutely, healthcare.

This event reinforces three critical truths for the healthcare sector:

The Attack Surface is Extrinsic: An organization's security posture is only as strong as the weakest link in its vendor chain. Third-party risk management (TPRM) is no longer a compliance exercise but a core cybersecurity function.

Legacy Vulnerabilities Have Long Tails: A vulnerability patched nearly a year ago continues to yield victim notifications, demonstrating that the lifecycle of a breach extends far beyond initial remediation.

Ransomware Economics are Evolving: The involvement of RansomHub shows that exfiltrated data retains value and can be weaponized multiple times by different actors, creating a persistent threat long after the initial incident is closed.

Recommendations for Stakeholders

For Affected Individuals:

Enroll in the offered credit monitoring services.
Place a fraud alert with major credit bureaus (Equifax, Experian, TransUnion) or initiate a full credit freeze.
Exercise extreme caution with unsolicited communications requesting personal or health information.
Scrutinize Explanation of Benefits (EOB) statements for fraudulent activity.

For Healthcare Organizations & Infosec Leadership:

Strengthen Third-Party Risk Management (TPRM): Conduct rigorous, continuous security assessments of all vendors with access to PHI/PII, enforcing strict cybersecurity requirements in contracts, including patching SLAs.

Adopt a Zero-Trust Architecture: Assume breach and enforce strict identity and access management (IAM) policies, ensuring vendors have least-privilege access.

Validate Incident Response Playbooks: Ensure playbooks include specific procedures for third-party-originated incidents and conduct tabletop exercises that simulate supply chain attacks.

Aggressively Patch Internet-Facing Systems: This incident serves as another potent reminder of the critical importance of rapid patch deployment for all public-facing applications.

The DaVita breach is a sobering testament to the interconnected and persistent nature of modern cyber threats.

For the healthcare industry, where the protection of human well-being is directly linked to data security, building resilience requires a holistic strategy that looks far beyond organizational perimeter defenses. The future of healthcare cybersecurity depends on forging a resilient, transparent, and vigilant ecosystem that can weather the relentless evolution of the ransomware threat.

DaVita Patient Data of 2.7 Million Exposed in Cascading Ransomware Supply Chain Attack

Related threat feeds

Daxin Malware Resurfaces in Taiwan Alongside Novel Stupig Backdoor After Decade Long Silence