CSIDB logo
Incident

DaVita Inc.

Incident posture

Attack window
Apr 2025
Location
United States of America
Status
Unknown
CIA posture
Available to members
Updated
2026-04-19 02:19

Linked entities

Victim
DaVita Inc.
Threat actors
0 actors
Sources
1 source

Timeline

Occurred
Apr 2025
Discovered
Pending
Disclosed
Pending
Resolved
Pending

Summary

DaVita Inc. became aware of a ransomware incident that encrypted certain elements of its network. Upon discovery, the company activated its response protocols, isolated affected systems, and began working with third‑party cybersecurity experts while notifying law enforcement. Contingency plans have been enacted to maintain patient care, though some operations remain impacted and interim measures are in place to restore functions, with the full scope and duration of the disruption still unknown. The investigation and remediation efforts are ongoing, and the ultimate impact on the company cannot be estimated at this time.

Motives

Detailed motive labels are available to members.

1 motive

TTPs

Detailed technique labels are available to members.

1 technique

Description

On April 12, 2025, DaVita Inc. became aware of a ransomware incident that had encrypted certain elements of its network. The company disclosed this event in a Form 8-K filed with the Securities and Exchange Commission on April 14, 2025. Upon discovery, DaVita activated its incident response protocols and began containment measures, which included proactively isolating the impacted systems. The organization engaged third‑party cybersecurity professionals to assist with assessment and remediation efforts. Law enforcement was notified of the matter as part of the response.

DaVita stated that it had implemented its contingency plans and continued to provide patient care despite the incident. The ransomware attack is affecting some of the company's operations, and interim measures have been put in place to allow for the restoration of certain functions. However, DaVita indicated that it cannot estimate the duration or extent of the disruption at this time. The investigation and response remain ongoing, and the full scope, nature, and potential ultimate impact on the company are not yet known. The forward‑looking statements in the filing note that actual outcomes could differ from current expectations due to uncertainties.

Sources

Sources available to members: 1 source.

CSIDB