Kettering Health

Kettering Health, a healthcare network operating 14 medical centers in Ohio, faced a cyberattack that led to a system-wide technology outage. This resulted in the cancellation of elective inpatient and outpatient procedures, affecting the call center and some patient care systems. The attack also involved scammers impersonating Kettering Health employees to request credit card payments from patients. The outage has been linked to the Interlock ransomware gang, which threatened to leak stolen information if the organization did not negotiate a ransom payment.

Source: https://www.bleepingcomputer.com/news/security/kettering-health-hit-by-system-wide-outage-after-ransomware-attack/

TPRM report: https://scoringcyber.rankiteo.com/company/kettering-health-network

"id": "ket832052125",
"linkid": "kettering-health-network",
"type": "Ransomware",
"date": "5/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'customers_affected': None,
                        'industry': 'Healthcare',
                        'location': 'Ohio, USA',
                        'name': 'Kettering Health',
                        'size': 'Over 15,000 employees, including more than '
                                '1,800 physicians',
                        'type': 'Healthcare Network'}],
 'customer_advisories': 'Patients advised to be cautious of scam calls '
                        'requesting credit card payments',
 'date_detected': '2023-05-20',
 'date_publicly_disclosed': '2023-05-20',
 'description': 'Kettering Health, a healthcare network operating 14 medical '
                'centers in Ohio, experienced a cyberattack that caused a '
                'system-wide technology outage, leading to the cancellation of '
                'inpatient and outpatient procedures.',
 'impact': {'downtime': ['Inpatient and Outpatient Procedures Cancelled',
                         'Call Center Outage'],
            'operational_impact': 'Elective procedures rescheduled',
            'systems_affected': ['Call Center', 'Patient Care Systems']},
 'investigation_status': 'Ongoing',
 'motivation': 'Financial Gain',
 'ransomware': {'ransomware_strain': 'Interlock'},
 'references': [{'date_accessed': None,
                 'source': 'Kettering Health Statement',
                 'url': None},
                {'date_accessed': None, 'source': 'CNN', 'url': None},
                {'date_accessed': None,
                 'source': 'BleepingComputer',
                 'url': None}],
 'response': {'communication_strategy': ['Public Statement',
                                         'Patient Advisories']},
 'threat_actor': 'Interlock Ransomware Gang',
 'title': 'Kettering Health Ransomware Attack',
 'type': 'Ransomware Attack'}