Dive Brief:
- DaVita has been hit by a ransomware attack that’s affecting operations, the kidney care provider said Monday.
- The dialysis company discovered the attack, which encrypted parts of its network, on Saturday, according to a securities filing. Davita then activated its response plans and isolated affected systems.
- The company did not disclose how its operations are being affected or how long the disruption will last, but said patient care is continuing.
Dive Insight:
DaVita, which operates more than 2,600 outpatient dialysis centers across the country, said the full scope and ultimate impact of its ransomware attack is unknown.
“We have activated backup systems and manual processes to ensure there's no disruption to patient care,” a spokesperson said in a statement to Healthcare Dive. “Our teams, along with external cybersecurity experts, are actively investigating this matter and working to restore systems as quickly as possible.”
Ransomware, a type of malware that denies users access to their data until a ransom is paid, has become an increasingly common threat to the healthcare sector.
Two-thirds of healthcare organizations said they were hit by an attack in the past year, according to a survey published in the fall by cybersecurity firm Sophos.
The latest ransomware incident comes after a year of significant cyberattacks on the healthcare industry. Change Healthcare, a technology and claims processing subsidiary of UnitedHealth, was hit by a ransomware attack early 2024, exposing data from about 190 million people — the largest healthcare data breach ever reported to federal regulators.
The large nonprofit hospital chain Ascension also faced a ransomware attack last spring. Responding to the attack hit the health system’s bottom line for 2024 and compromised information from about 5.5 million people, according to the HHS’ Office for Civil Rights.
Ransomware can at times make care delivery much more difficult. The attacks can shut off access to critical systems, like electronic health records, and force providers to delay appointments or send emergency cases to nearby facilities — potentially affecting capacity at other hospitals in the community.
