Dialysis Chain Tells Feds Hack Affects Nearly 2.7 Million

Months after cybercriminal gang Interlock claimed to have stolen more than 1.5 terabytes of patient data from kidney dialysis chain DaVita, the company told federal regulators that the cyberattack first disclosed in April has affected nearly 2.7 million people.

See Also: A Modern Approach to Data Security

Interlock’s leak site as of Friday listed a variety of alleged DaVita files and folders, including those labeled as patient accounting records, government and payer eligibility of benefits documents, lab results, and various studies.

In an Aug. 1 report filed to the U.S. Department of Health and Human Services, DaVita said its hacking/IT incident involved a network server and affected more than 2.68 million people. HHS’ Office for Civil Rights on Friday posted the report on its HIPAA Breach Reporting Tool website listing health data breaches affecting 500 or more people. Updates on the size of the breach have come through several of the company breach reports filed with some state regulators that indicated the data theft and ransomware attack affected at least 1 million people.

As of Friday, the DaVita hack ranked as the fourth-largest health data breach reported to federal regulators so far in 2025.

DaVita did not immediately respond to Information Security Media Group’s request for additional details about the hack, including a comment on Interlock’s dark web claims.

DaVita, one of the largest kidney dialysis providers in the world, told the U.S. Securities and Exchange Commission earlier this month that the April cyberattack has cost the company $13.5 million so far (see: Dialysis Firm Attack Affects 1 Million, Costs $13.5M to Date).

In its breach notice, DaVita said that on April 12, it discovered a security incident that resulted in unauthorized access to some DaVita network servers, primarily at its laboratories. “Upon discovery, we initiated our incident response protocols and were able to eradicate the unauthorized party from our systems on that day,” DaVita said.

DaVita said it worked with third-party forensics experts to determine what information was accessed and removed by the threat actor. “Through an extensive investigation, we understand that the cyber incident started on March 24 and continued until the threat actor was blocked from our servers on April 12.”

Information compromised affected DaVita’s dialysis labs database, the company said. The affected information varied by individual, but may include name, address, date of birth, Social Security number, health insurance-related information, and other identifiers internal to DaVita.

Clinical information is potentially affected, including health condition, other treatment information, and certain dialysis lab test results. “For some individuals, the information included tax identification numbers, and in limited cases images of checks written to DaVita,” the company said.

In the wake of the data breach, DaVita said it has taken “additional steps to safeguard our systems and information by deploying additional security monitoring tools and enhanced system controls.”