Interlock ransomware claims theft of 20TB from DaVita Healthcare, leaking 1.5TB of sensitive patient data. Millions face privacy risks as hackers auction critical dialysis patient details. Learn about the breach's impact and expert insights
Continue reading
Denver, CO — Patients reliant on life-saving dialysis treatments from DaVita Healthcare Partners Inc. are confronting a new threat: the potential exposure of their sensitive personal and medical data. The Interlock ransomware group, a rising cybercriminal entity, has claimed responsibility for stealing 20 terabytes of data from the healthcare giant, including the personal details of millions of patients. While 1.5 terabytes of this data have already been leaked on the dark web, the group is now attempting to monetize the remaining 18.5 terabytes, escalating fears of widespread identity theft, insurance fraud, and privacy violations.
The cyberattack unfolded on April 12, 2025, when Interlock infiltrated DaVita’s systems, encrypting critical infrastructure and disrupting internal operations. DaVita, which operates over 3,000 outpatient dialysis centers globally and serves approximately 281,100 patients, promptly notified the U.S. Securities and Exchange Commission (SEC) but withheld specifics to avoid compromising its investigation. The disclosure triggered a 3% drop in DaVita’s stock price, reflecting investor anxiety over the breach’s financial and reputational fallout.
By early May, Interlock began leaking stolen data on its dark web portal, including patient names, Social Security numbers, medical histories, and treatment records. Screenshots reviewed by Hackread.com confirm the authenticity of some posted files, though DaVita has yet to verify the full extent of the breach.
_“We are disappointed in these actions against the healthcare community and will continue working to defend against such attacks,”_ a DaVita spokesperson said, emphasizing efforts to safeguard patient care continuity.
Emerging in October 2024, Interlock has rapidly gained notoriety for high-impact ransomware campaigns. The group employs a double-extortion model: encrypting victims’ systems and exfiltrating data to pressure organizations into paying ransoms. According to Paul Bischoff, Consumer Privacy Advocate at Comparitech, Interlock has executed 13 confirmed attacks and claims 17 U.S. healthcare breaches in 2025 alone.
_“Healthcare providers are prime targets due to the critical nature of their services and the sensitivity of patient data,”_ Bischoff told Hackread.com. _“Attacks like DaVita’s can paralyze operations and leave victims vulnerable to exploitation for years.”_
Interlock’s prior targets include the Texas Tech University Health Sciences Center, where a 2024 breach compromised records of 530,000 individuals. The group’s escalating activity mirrors a broader crisis: 25.7 million patient records were exposed in 160 healthcare ransomware incidents in 2024, per Comparitech data.
The DaVita breach poses dire risks for patients, particularly those undergoing dialysis—a lifeline for individuals with end-stage renal disease. Leaked data could enable:
Cybersecurity experts warn that even partial data leaks can have cascading consequences. “Once data is on the dark web, it’s nearly impossible to retract,” Bischoff noted. “Victims must monitor their accounts indefinitely.”
DaVita has activated incident response protocols, including third-party cybersecurity audits and patient notification systems. However, the company faces mounting scrutiny over its data protection practices. Under the Health Insurance Portability and Accountability Act (HIPAA), healthcare providers must implement safeguards against cyber threats—a standard critics argue DaVita failed to meet.
The breach also reignites debates about ransomware payments. While DaVita has not confirmed whether it negotiated with Interlock, the FBI discourages payments, arguing they incentivize further attacks.
As DaVita races to contain the fallout, the Interlock breach serves as a grim reminder: in an era of escalating cyber warfare, healthcare providers—and the patients who depend on them—are increasingly in the crosshairs.
148 malicious npm packages masquerading as student proxy and school Wi-Fi bypass tools. Rather than compromising developers during installation
