INCIDENT REPORT · CP-2025-007

Kettering Health ransomware attack

L3 · ELEVATEDCONFIRMED

A ransomware attack caused a system-wide outage at Ohio's Kettering Health network of 14 medical centers; the health system linked the incident to the Interlock group.

Incident ID: CP-2025-007
Incident date: 20 MAY 2025
Detection date: 20 MAY 2025
Affected countries: United States
Plotted location: Kettering, Ohio, United States (Affected organization headquarters)
Threat classification: Level 3 — ELEVATED
Classification rationale: Weeks-long disruption of patient care across a 14-hospital regional system.
Attack type: Ransomware
Nature: Malicious activity
Attack vector: Not publicly documented
Sectors: Healthcare
Critical infrastructure: Yes
Organizations affected: Kettering Health
Operational consequences: Elective inpatient and outpatient procedures were cancelled and the call centre went down; normal operations for key services resumed about three weeks later. The HHS breach portal was later updated to show about 1.7 million people affected.
Estimated financial impact: No reliably documented figure
Attribution (as stated): Linked by Kettering Health to the Interlock ransomware group, which claimed the attack

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

Kettering Health ransomware attack

L3 · ELEVATEDCONFIRMED

A ransomware attack caused a system-wide outage at Ohio's Kettering Health network of 14 medical centers; the health system linked the incident to the Interlock group.

Incident ID

CP-2025-007

Incident date

20 MAY 2025

Detection date

20 MAY 2025

Affected countries

United States

Plotted location

Kettering, Ohio, United States (Affected organization headquarters)

Threat classification

Level 3 — ELEVATED

Classification rationale

Weeks-long disruption of patient care across a 14-hospital regional system.

Attack type

Ransomware

Nature

Malicious activity

Attack vector

Not publicly documented

Sectors

Healthcare

Critical infrastructure

Yes

Organizations affected

Kettering Health

Operational consequences

Elective inpatient and outpatient procedures were cancelled and the call centre went down; normal operations for key services resumed about three weeks later. The HHS breach portal was later updated to show about 1.7 million people affected.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

Linked by Kettering Health to the Interlock ransomware group, which claimed the attack