DaVita
Disclosed Apr 14, 20251 year ago2,689,826 affectedConfirmed
Interlock ransomware attack on DaVita exposes 2.7 million people
DaVita disclosed an April 12, 2025 ransomware attack that encrypted parts of its network; Interlock claimed it and leaked 1.5 TB of data. DaVita later reported 2,689,826 affected people to HHS, with names, SSNs, insurance and clinical data taken.
What is known
| People affected | 2,689,826 (as reported to HHS) |
|---|---|
| Disclosed | Apr 14, 2025 |
| Discovered | Apr 12, 2025 |
| Happened | Mar 24, 2025 |
| Attack | Ransomware |
| Data exposed | Names, Health, Addresses, Dates of birth, Social Security numbers, Insurance, Financial |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Washington Attorney General breach notice: DaVitaatg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: DaVitajustice.oregon.gov · Official notice | Official notice |
| HHS OCR breach report: DaVita (Healthcare Provider, CO)ocrportal.hhs.gov · Official notice | Official notice |
| DaVita says ransomware gang stole data of nearly 2.7 million peoplebleepingcomputer.com · News | News |
| Kidney dialysis firm DaVita hit by weekend ransomware attackbleepingcomputer.com · News | News |
| August 2025 Healthcare Data Breach Reporthipaajournal.com · News | News |
| DaVita Form 8-K Item 8.01sec.gov · SEC filing | SEC filing |
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | Apr 14, 2025 | 2,689,826 |
| Washington AGresidents of WA | Aug 1, 2025 | 13,404 |
| Oregon DOJresidents of OR | Aug 1, 2025 | 915,952 |
| HHS OCRtotal | Aug 1, 2025 | 2,689,826 |
Other breaches at DaVita
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Disclosed Jul 3, 2024Jul 3, 20242 years agoInsider | Jul 3, 20242 years ago | Insider | Healthcare | Confirmed | 67K |
| Disclosed Sep 6, 2022Sep 6, 20224 years agoHacking | Sep 6, 20224 years ago | Hacking | Healthcare | Confirmed | 1,092 |
| Disclosed Nov 5, 2013Nov 5, 201312 years agoLost or stolen device | Nov 5, 201312 years ago | Lost or stolen device | Healthcare | Confirmed | 12K |
History of this record
- 2026-09-25 · data_types: ["names","health"] to ["names","health","addresses","dob","ssn","insurance","financial"] · seed source
- 2026-09-25 · disclosed: 2025-08-01 to 2025-04-14 · seed source
- 2026-09-25 · summary: empty to DaVita disclosed an April 12, 2025 ransomware attack that encrypted parts of its network; Interlock claimed it and leaked 1.5 TB of data. DaVita later reported 2,689,826 affected people to HHS, with names, SSNs, insurance and clinical data · seed source
- 2026-09-25 · title: empty to Interlock ransomware attack on DaVita exposes 2.7 million people · seed source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 2689826 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Washington AG), confirmed by Washington AG. Record counts are as reported. Not legal advice.