Interlock Held DaVita for 19 Days and Took Records on 2.7 Million People

The Interlock ransomware group had access to systems at the kidney dialysis provider DaVita from 24 March to 12 April 2025 — nineteen days. It reached a laboratory database holding protected health information for 2,689,826 individuals. Reporting indicates critical care delivered to patients across the United States was not affected.

A patient on maintenance haemodialysis typically requires treatment three times a week. Missing sessions is not an inconvenience; it produces fluid overload and electrolyte derangement on a timescale of days.

There is no version of "we will reschedule when systems are back" that works. Whatever DaVita had in place to keep treatment running through a nineteen-day intrusion is the most consequential fact in this file, and it is the part that received the least coverage.

The compromised system held laboratory data — which for a dialysis population is a detailed longitudinal clinical record: kidney function over time, comorbidities, medication response.

That is a more revealing dataset than a typical patient index. It is the ambulatory-monitoring problem this desk filed at 26-0617 in a different form: continuous clinical measurement is a more intimate record than an episodic one.

Against the dwell times in this database — 304 days at Estée Lauder in 26-0620, five months at Salesloft in 25-0820 — nineteen days indicates reasonably effective detection.

It was still sufficient to locate and exfiltrate a database covering 2.7 million people. Detection speed bounds the damage; it does not prevent it, which is the argument this desk made from the other direction at 26-0630.