Ransomware Attack Disrupts Global Dialysis Provider DiVita

Denver-based DaVita Inc., which runs more than 3,100 dialysis and kidney care facilities in the U.S. and 13 other countries, reported to the U.S. Securities and Exchange Commission that a ransomware attack over the weekend is disrupting some of its operations.

See Also: Top 10 Technical Predictions for 2025

DaVita told the SEC that it became aware of the ransomware incident on Saturday, and that the attack has encrypted “certain elements” of its network.

“Upon discovery, we activated our response protocols and implemented containment measures, including proactively isolating impacted systems,” DaVita said.

The company reported that it is working to assess and remediate the incident with the assistance of third-party cybersecurity professionals. DaVita has also notified law enforcement about the attack.

“We have implemented our contingency plans, and we continue to provide patient care,” DaVita said. “However, the incident is impacting some of our operations, and while we have implemented interim measures to allow for the restoration of certain functions, we cannot estimate the duration or extent of the disruption at this time,” the company said.

Because the incident just happened, and the response and investigation is ongoing, “the full scope, nature and potential ultimate impact on the company are not yet known,” DaVita said.

DaVita, which has been in business for 25 years, reported nearly $12.82 billion in revenue in 2024. The company said that last year, it provided dialysis services to a total of approximately 281,100 patients in 3,166 outpatient dialysis centers, including at more than 750 hospital partners. Of DaVita’s outpatient facilities, 2,657 centers are located in the U.S. and 509 centers were located in 13 other countries.

Those countries include Brazil, Chile, Columbia, Ecuador, Germany, Malaysia, Poland, Portugal, Saudi Arabia, Singapore, the United Kingdom and several other nations.

DaVita also provides at-home dialysis services.

“There is potential for a very large impact, given DaVita’s scale of operations,” said Scott Weinberg, CEO of managed service firm Neovera. “If patient records were encrypted, sensitive data like medical histories and personal identifiers might be at risk. DaVita has not reported data exfiltration, so it’s not clear if data was stolen or not,” he said.

The disruption to DaVita and the potential effect on patient services is concerning, Weinberg said. “For dialysis patients needing regular treatments to survive, this attack is extremely serious,” he said. “Because of disrupted scheduling or inaccessible records, this could lead to health complications. Ransomware disruptions in healthcare may lead to an increase in mortality rates, especially for time-sensitive treatments such as dialysis.”

In addition to the sheer volume of records at risk, the operation in other countries could potentially be a significant regulatory problem for DaVita, said Erich Kron, security awareness advocate at security firm KnowBe4.

“Regulations can differ with respect to penalties and reporting requirements after a breach based on the country and even the state in which the patients live or were treated,” he said.

A serious cybersecurity incident that affects individuals in multiple countries “can be a legal nightmare for some organizations,” Kron said.

“However, this is something that organizations should plan for and be prepared for prior to an event ever happening,” he said. “They should already know what will be required to meet regulatory standards for the regions in which they operate.”

DaVita declined Information Security Media Group’s request for additional details about its ransomware attack, including whether the incident involved data exfiltration.

“We have activated backup systems and manual processes to ensure there’s no disruption to patient care,” DaVita told ISMG in a statement. “Our teams, along with external cybersecurity experts, are actively investigating this matter and working to restore systems as quickly as possible.”

Appealing Targets

Of course, the attack on DaVita parallels other similarly disruptive incidents in the healthcare sector in recent years.

“The healthcare sector is always considered a lucrative target because of the serious sense of urgency whenever IT operations are disrupted, not to mention potentially disabled,” said Jeff Wichman, director of incident response at security firm Semperis.

“In case of ransomware attacks, this serves as another means to pressure the victim into paying a ransom,” he said.

“At this time, if any systems administering dialysis have been disrupted, the clinics and hospitals within DaVita’s network are most certainly operating machines manually as a last resort and staff are working extremely hard to ensure patient care doesn’t suffer,” he said.

“If any electronic machines in their network are down, the diligence of staff will fill the gaps until electronic equipment is restored.”

DaVita is also among many other specialty healthcare providers falling victim to significant hacking incident in recent months. Other specialty medical entities reporting major breaches so far in 2025 includes a hack on Community Care Alliance, which offers programs for individuals dealing with mental illness, addiction, housing issues and trauma-related issues in Rhode Island. That incident affected 115,000 people.

As for DaVita, the company has previously reported at least three large health data breaches to the U.S. Department of Health and Human Services and state regulators over the years.

Aside from dealing with its current ransomware attack, DaVita reported its largest breach in July 2024 as an unauthorized access/disclosure incident involving a network server that affected 67,443 individuals. That incident was tied to DaVita’s previous use of online tracking pixels on its patient portal and mobile applications.