Kettering Health has officially confirmed that the ransomware group Interlock was responsible for a major cybersecurity incident that crippled the healthcare system’s operations for over two weeks, forcing the organization to implement extensive downtime procedures and reschedule numerous patient appointments and elective procedures.
On Tuesday, May 20, 2025, Kettering Health experienced what initially appeared to be a routine technology outage but was later confirmed to be a sophisticated ransomware attack orchestrated by the Interlock group.
The incident resulted in unauthorized access to the organization’s network, prompting immediate containment measures and a comprehensive security response.
The healthcare system acknowledged the cybersecurity nature of the incident within hours, stating they had “taken steps to contain and mitigate this activity and are actively investigating and monitoring the situation”.
The attack forced Kettering Health to cancel all elective inpatient and outpatient procedures on the day of the incident, while emergency departments and urgent care facilities remained operational under manual procedures.
The organization’s call center systems were also severely impacted, limiting patients’ ability to contact their healthcare providers through normal channels.
To address urgent clinical needs, Kettering Health established a temporary phone line staffed by registered nurses, though officials emphasized this service was reserved for urgent medical concerns only.
Interlock Ransomware Breach
The recovery process proved lengthy and complex, with healthcare industry experts noting that such cybersecurity events typically require 10 to 20 days for full restoration.
Kettering Health’s response included complete threat removal, with officials confirming that “the tools and persistence mechanisms used by the third-party group have been eradicated, and all affected systems have been secured”.
The organization conducted thorough security enhancements with external partners, implementing network segmentation, enhanced monitoring, and updated access controls.
A significant milestone occurred on June 2, 2025, when Kettering Health successfully launched the core components of its Epic electronic health record (EHR) system.
This restoration involved over 200 individuals, including Kettering Health Information Systems team members, clinical staff, and Epic partners, working collaboratively to reestablish the organization’s ability to update and access electronic health records.
The Epic system restoration marked a crucial step toward normal operations, enabling improved communication across care teams and more efficient patient care coordination.
Security Measures and Patient Impact
Following the incident, Kettering Health implemented comprehensive security protocols and vulnerability assessments to prevent future attacks.
The organization expressed confidence in its updated cybersecurity framework and employee security training programs, stating they are “sufficient to mitigate future risks”.
All network-connected devices underwent security verification, and connections to partner organizations were fully protected.
During the outage period, the healthcare system maintained operations through established downtime procedures, though patients experienced significant disruptions to scheduling and communication services.
Kettering Health warned the community about potential scam communications targeting individuals connected to the organization, advising recipients of suspicious emails, calls, or text messages to avoid responding and report incidents to local authorities.
The organization emphasized that it would never reach out to staff or patients via social media platforms.
The incident highlighted the growing cybersecurity threats facing healthcare organizations and the critical importance of robust incident response procedures in maintaining patient care continuity during system disruptions.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.
