The Interlock ransomware has claimed responsibility for the recent cyberattack on dialysis service provider DaVita, while also publishing data allegedly hacked from the organization.
DaVita operates over 2,600 dialysis units in the U.S. and employs 76,000 people in 12 countries.
The company disclosed to the U.S. Securities and Exchange Commission (SEC) that it was hit by a ransomware attack on April 12 , affecting some of its operations. At the time, DaVita said it was investigating the extent of the incident. Now, the Interlock group has confirmed that it is behind the attack , listing DaVita on its list of victims on its dark web data breach site.
See also: Medusa Ransomware demands $4 million ransom from NASCAR
According to the group, they are in possession of approximately 1.5 terabytes of data, corresponding to nearly 700,000 files, including sensitive medical information, user account data, insurance details, and financial documents.
The Interlock ransomware group published the files on its data leakage platform (DLS), suggesting that negotiations for a ransom payment from DaVita failed.
Bleeping Computer reportedly contacted the company, and a spokesperson made the following statement: “We are aware of the dark web posting and are in the process of thoroughly reviewing the data involved. The full investigation into the incident is still ongoing. We are moving forward as quickly as possible and will update the parties and individuals involved as necessary.”
The spokesman said he was disappointed by these "actions against the healthcare community."
See also: Arcus Media ransomware: Did it target the National Audit Office of Kiribati?
Those who have received medical services at a DaVita center and have shared sensitive personal information with the organization should be on the lookout for possible attempts phishing and report any suspicious communication to the appropriate authorities.
Interlock is one of the newest groups to enter the ransomware scene. It first appeared in September 2024 and targets both Windows and FreeBSD.
Although it does not work with external partners or affiliates, it remains an active and constantly evolving threat, having claimed responsibility for a dozen confirmed attacks. In several cases, it claims to have intercepted huge volumes of data from its targets' networks.
See also: Fourlis Group – IKEA: Losses from ransomware attack reached €20 million.
DaVita: Ransomware attack led to data leak
Proactive protection is critical to avoiding business disruptions and data breaches. Some helpful practices include:
☁️ Keep safe copies with Proton Drive
Encrypted cloud storage from Proton — protect your files from ransomware, corruption, and data loss with end-to-end encryption.
- ✔ End-to-end encrypted files & backups
- ✔ Version history — recover files after ransomware
- ✔ Free space — sync across all devices
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
- Implement multi-factor authentication (MFA) for all user accounts
- Enable firewall on all devices connected to the network
- Encryption of sensitive data
- Updating devices and systems with the latest security patches
- Conducting regular security audits and penetration testing
- Using strong, unique passwords
- Limiting user access to only necessary systems and information
- Use solutions email security for additional protection against phishing attacks
- Recovery plan for rapid restoration of systems in the event of an attack
- Regular data backups
Source: www.bleepingcomputer.com
