Desk live·
ForensicPost
Ransomware/Healthcare/File 25-0520

Kettering Health Shut 600 Applications After Attack Affecting 1.7 Million

Kettering Health shut down around 600 digital applications after a May 2025 attack affecting 1.7 million people. Staff recorded patient information by hand while systems were restored.

Constructed geometry · not a chart of case data
JurisdictionUSAKettering, Ohiothe affected organisation’s jurisdiction, not the actor’s suspected origin
TargetKettering Health
ActorUnattributed
S. Rosler & D. Kennedy12 min readConfidence: high2 sources reviewed

Kettering Health was attacked on 20 May 2025, affecting 1.7 million individuals. The health system cancelled appointments and shut down approximately 600 digital applications while restoring systems. Employees switched to pen and paper to record patient information.

Six Hundred Is The Number Worth Sitting With

Most people, asked how many distinct applications a hospital runs, would guess a few dozen. The real figure at a mid-sized health system is in the hundreds, accumulated over decades: scheduling, imaging, pharmacy, laboratory, billing, transcription, bed management, staff rostering, specialty registries, device integrations.

Each was procured for a reason, each has a clinical constituency, and most have no owner who could tell you today what would break if it stopped.

Shutting Them Down Was The Decision, Not The Damage

This desk made the argument at West Pharmaceutical in 26-0507 and TruStage in 26-0715b: disconnecting early is frequently correct containment and always looks worst.

Doing it across 600 applications in a live hospital is that decision at maximum difficulty. It means accepting certain, immediate clinical disruption in exchange for bounding an intrusion you cannot yet scope.

Paper Works Because Somebody Kept It Working

Staff reverting to handwritten records is the fallback this database keeps recording — at Brockton in 26-0407, at New Britain in 26-0126, at the European airports in 25-0919.

In healthcare it carries a specific cost the other sectors do not: every handwritten record must eventually be reconciled into the electronic record, and the reconciliation itself introduces clinical risk. A fortnight of paper is not a fortnight of delay — it is a fortnight of delay plus a data-integrity project.

How we reported this

Compiled from public reporting, listed below. Attribution has not been established by this desk. We have not reviewed clinical outcomes. Corrections: corrections@forensicpost.com.

Sources
  1. Kettering Health ransomware attack: 1.7 million individuals affectedHIPAA Journal
  2. Hospitals under attack: ransomware in healthcare in 2025CyberGlobal
S. Rosler
Covers extortion groups and leak-site economics. Verifies our sample sets.
D. Kennedy
Identity and access reporter. Former DFIR consultant. Signal on request.
// the chain of custody — tuesdays

Get the next file first.

One incident a week, taken apart properly. Logs, timelines, and what the filing left out.

PGP-signed edition · no tracking pixels · one-click unsubscribe
© 2026 ForensicPost Media · the desk · newsletter · searchGlossary