DaVita ransomware attack: dialysis lab data taken March 24 to April 12, 2025, 2.7 million people

What happened at DaVita?

On April 12, 2025 DaVita became aware of a ransomware incident that had encrypted parts of its network. It isolated affected systems, brought in outside cybersecurity professionals, notified law enforcement and kept treating patients under contingency plans. It told investors the incident was affecting some operations and that it could not yet estimate how long the disruption would last.

The patient letter, sent later, gives the full window. The intrusion started on March 24, 2025 and lasted until the attacker was blocked from DaVita's servers on April 12. The servers reached were mainly at its laboratories.

Date	What happened	Source
March 24, 2025	Intrusion begins	DaVita letter; Oregon list
April 12, 2025	Ransomware found; attacker removed the same day	8-K; DaVita letter
April 14, 2025	8-K filed with the SEC	8-K
On or about June 18, 2025	DaVita confirms whose data was involved	DaVita letter
August 1, 2025	Letters sent; notice to Oregon	Oregon list
November 28, 2025	Experian enrollment deadline	DaVita letter

Letters went out 111 days after the ransomware was found. The notice-delay guide compares that with other notices.

What information was exposed?

It varies by person. The letter lists name, address, date of birth, Social Security number, health insurance information and DaVita's internal identifiers, along with clinical information: health conditions, other treatment information and some dialysis lab test results. For some people, tax identification numbers were included, and in a few cases images of checks written to DaVita.

How many people were affected?

About 2.7 million. The federal health breach portal, checked on November 13, 2026, lists DaVita Inc. as a health care provider with 2,689,826 people affected, in a hacking incident on a network server reported on August 1, 2025. The HIPAA Journal reported the same 2,689,826 in August 2025. Reuters reported the same 2.7 million from the HHS website on August 21, 2025. Oregon's list counts 915,952. The 8-K gives no count. Oregon also holds a separate, earlier DaVita report, sent July 3, 2024 for a breach window from 2017 to 2023, with no count listed. The largest healthcare data breaches ranking covers 2026 reports; this one was reported in 2025.

Count	Source	People
Federal health breach report	HHS breach portal (reported Aug 1, 2025; checked Nov 13, 2026)	2,689,826
Oregon	Oregon DOJ list	915,952

Who was behind the DaVita ransomware attack?

DaVita has not named the attacker, and its letters do not use the word ransomware. The HIPAA Journal reported that the Interlock ransomware group claimed responsibility. The group said it had stolen more than 20 TB of databases, with more than 200 million rows of patient data. That is the group's claim, not a figure DaVita has confirmed.

What did the DaVita attack cost?

About $13.5 million in the second quarter of 2025, Reuters reported from the company's figures. $1 million went to patient care costs and $12.5 million to general and administrative expenses, to remediate the incident and restore systems with outside help. DaVita told Reuters that critical care continued without interruption.

What did DaVita offer?

Experian IdentityWorks credit monitoring at no cost, for the number of months printed in each letter, with an enrollment deadline of November 28, 2025. That deadline has passed. DaVita's line for questions is 833-931-7489, Monday to Friday, 8 a.m. to 8 p.m. Central Time. The guide to credit monitoring offers explains what a free credit freeze adds.

How many Washingtonians were affected by the DaVita breach?

Washington's attorney general lists a notice from DaVita Inc., reported on August 1, 2025, with a breach date of March 24, 2025 and 13,404 Washingtonians affected. The record lists names, Social Security numbers, driver's license or state ID numbers, financial and banking information, full dates of birth, health insurance policy or ID numbers and medical information as the information compromised. The figure counts Washington residents only.

What the record leaves open

• How the attacker got in on March 24, 2025.
• Whether a ransom was paid; the 8-K and the letter do not say, and DaVita has not confirmed the Interlock claim.
• Why the Oregon count (915,952) and the federal count (2,689,826) differ.
• How many patients had lab results or check images in the data.