DaVita Hit by Ransomware Attack Disrupting Operations, Patient Care Continues

DaVita Inc. disclosed that it had been hit by a ransomware attack over the weekend that encrypted portions of its network, prompting the healthcare provider to initiate its incident response protocols and isolate affected systems.

The company confirmed that patient care services are still being provided but acknowledged that some operations are being disrupted. No ransomware groups have claimed responsibility for the attack as of this writing.

The breach was revealed in a Form 8-K filing with the U.S. Securities and Exchange Commission, where DaVita stated it had enlisted third-party cybersecurity experts to assist with the investigation and remediation efforts. Law enforcement agencies have also been notified. The company has not provided an estimate of how long the disruption will last or the extent of the impact on its systems and operations, citing the early stage of its ongoing investigation.

DaVita, headquartered in Denver, Colorado, operates one of the largest networks of dialysis centers in the United States, providing life-sustaining care to patients with chronic kidney failure. With thousands of clinics nationwide and a significant global footprint, DaVita’s digital infrastructure is critical to both patient care coordination and administrative operations, making it a high-value target for cybercriminal groups.

In its filing, DaVita emphasized that contingency plans were enacted quickly following the discovery of the attack, allowing some critical functions to be restored through interim measures. However, the company cautioned that further disruptions may occur as the situation evolves and more systems are brought back online.

As of now, no threat actor has publicly taken credit for the ransomware incident, and the strain of malware used in the attack has not been identified. Also, whether or not sensitive patient data has been stolen during the attack is unknown.

In light of the incident, healthcare organizations are reminded to ensure that endpoint protection, network segmentation, and data backup protocols are fully in place and regularly tested. Timely application of security patches, staff awareness training, and adoption of zero-trust principles remain critical defenses against ransomware threats.