DaVita Data Breach 2025: Interlock Ransomware Hits Largest US Dialysis Provider, 2.7M Patients Exposed. What To Do

What happened

DaVita Inc. is the largest dialysis provider in the United States. It runs roughly 3,100 outpatient dialysis centers, plus inpatient critical-care and laboratory services, and trades on the NYSE under the ticker DVA. On April 12, 2025, DaVita detected an active intrusion on its network. Forensic investigators later established that the Interlock ransomware group had been inside since March 24, 2025, with access concentrated on DaVita’s laboratory systems.

DaVita filed a Form 8-K with the SEC on April 14, 2025, characterizing the event as “a ransomware incident that encrypted certain elements” of its network and was “causing some operational disruption.” On April 24, 2025, Interlock claimed responsibility and posted a listing on its dark-web leak site advertising roughly 1.5 terabytes of DaVita data across approximately 683,000 files. Interlock further claimed it held over 20 TB in total, with more than 200 million rows of patient records.

DaVita filed its HIPAA breach report with the HHS Office for Civil Rights on August 1, 2025, reporting 2,689,826 individuals affected. Patient notification letters began mailing on August 5, 2025.

What was exposed

Per DaVita’s notification letter, the affected information varies by individual but may include:

• Name, address, date of birth
• Social Security number
• Health insurance information
• Internal DaVita identifiers
• Health conditions and other treatment information
• Dialysis lab test results
• Tax identification number (some individuals)
• Images of checks written to DaVita (limited number)

The mix matters. This is not a benign “name and address” leak. For a sizeable population of dialysis patients, clinical lab results and treatment information sit on the Interlock leak site alongside SSNs, which puts both medical identity fraud and traditional financial identity theft in scope.

Interlock and the leak-site posture

Interlock is a ransomware-as-a-service operation that emerged in 2024 and runs the standard double-extortion playbook: encrypt for operational leverage, exfiltrate for blackmail leverage. DaVita appears not to have paid the ransom. The DaVita listing remained live on Interlock’s leak site after disclosure, and the ~1.5 TB tranche was released. Independent breach-tracking outlets including DataBreaches.net and BlackFog have documented the listing. (HealthConsent does not link to or mirror the leak-site content.)

Operational impact

DaVita publicly stated that patient care continued without interruption throughout the incident. The company moved to manual processes and backup protocols at affected facilities, isolated compromised systems, and brought in external forensics. DaVita disclosed approximately $13.5 million in incident-related costs in its Q2 2025 results, covering forensics, remediation, and patient protection services.

Litigation and regulatory status

Within weeks of DaVita’s August notification mailings, at least three putative class actions had been filed in the U.S. District Court for the District of Colorado, including:

• Reid v. DaVita Inc., No. 1:25-cv-01362 (D. Colo.)
• Jenkins v. DaVita Inc., No. 1:25-cv-01358-SBP (D. Colo.)

Plaintiffs assert negligence, breach of implied contract, and violations of common-law and statutory duties under the FTC Act and HIPAA, arguing DaVita failed to implement adequate data-security measures. The HHS OCR investigation remains open. State attorney general notifications were filed in jurisdictions that require them; no public AG enforcement action has been announced.

What DaVita is offering

DaVita is offering complimentary identity restoration services through Experian to affected individuals. Per the notification letter, enrollment is available until November 28, 2025. The activation code is included in the mailed letter.

What to do if you are a DaVita patient

1. Enroll in the offered Experian identity restoration program before the enrollment deadline using the code from your letter.
2. Freeze your credit at all three nationwide bureaus (Equifax, Experian, TransUnion). Full SSN is in scope. Freezes are free and reversible.
3. File IRS Form 14039 (Identity Theft Affidavit) if you see any unfamiliar tax activity — tax identification numbers and check images are in scope for some patients.
4. Watch your insurance Explanation of Benefits and Medicare Summary Notices for unfamiliar dialysis-related or other claims. Medical identity theft is the harder-to-detect downstream consequence here.
5. Set up account alerts on any bank account from which you have written checks to DaVita. Check images on the leak site can support targeted check-fraud attempts.
6. Be skeptical of dialysis- or kidney-care-themed phone calls and emails for at least 12 months. Treatment details on the leak site enable convincing pretexting.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2025 healthcare data breaches