Ransomware Gang Interlock Claims Responsibility for Kettering Health Hack, Exfiltrating 940GB of Data

The ransomware group Interlock has claimed responsibility for the cyberattack on Kettering Health, a hospital network in Ohio, weeks after the incident severely disrupted the healthcare provider’s operations. The group asserts it stole over 940 gigabytes of data from Kettering Health’s systems. TechCrunch reported that Kettering Health is still recovering from the attack, which forced the shutdown of its computer systems.

Interlock, a relatively new ransomware group, has been actively targeting healthcare organizations in the U.S. since September 2024, according to a report by HIPAA Journal. The group made its claim via a post on its dark web site.

CNN initially reported on May 20 that Interlock was suspected of being behind the Kettering Health breach. At that time, Interlock had not publicly acknowledged its involvement. This silence often indicates ongoing ransom negotiations, where cybercriminals attempt to extort payment in exchange for not releasing stolen data. Interlock’s recent public claim may suggest that negotiations with Kettering Health have stalled or failed.

John Weimer, Kettering Health’s senior vice president of emergency operations, stated earlier that the healthcare system has not paid any ransom to the hackers.

TechCrunch reached out to TK, a spokesperson for Kettering Health, for comment but did not receive a response by press time. Interlock also did not respond to a request for comment sent to the email address listed on their dark web site.

An initial review of files published by Interlock on its dark web site suggests that the hackers exfiltrated a wide range of sensitive data from Kettering Health’s internal network. This includes private health information such as patient names, patient numbers, and clinical summaries containing details on mental status, medications, health concerns, and other patient data. Employee data and the contents of shared drives were also compromised.

One folder contained sensitive information belonging to police officers with the Kettering Health Police Department, including background files, polygraphs, and other private identifying details.

Kettering Health released an update on Monday, stating that it has restored “core components” of its electronic health record system provided by Epic. The company said this restoration is “a major milestone” that will allow them to “update and access electronic health records, facilitate communication across care teams, and coordinate patient care with greater speed and clarity.”