Originally published May 9, 2025 · Updated October 20, 2026
DaVita's 2025 ransomware incident shows how a cyberattack on a healthcare provider can affect more than its computers. The company reported disruption to its operations while it worked to keep dialysis care available. Later disclosures confirmed that some personal and protected health information was taken. The public record also shows why incident reporting should distinguish what was known at discovery from what an investigation established months later.
What DaVita reported
DaVita said it became aware of a ransomware incident on April 12, 2025. According to its April 14 filing with the Securities and Exchange Commission, the attack encrypted parts of its network. The company isolated affected systems, brought in outside cybersecurity professionals, notified law enforcement, and activated contingency plans. It continued to provide patient care, although some operations were affected. At that point, DaVita said the full scope and impact were still unknown.
The picture became clearer in later company filings. In its report for the quarter ended June 30, 2025, DaVita said it was aware that some data had been exfiltrated, including personally identifiable information and/or protected health information from its laboratory business. It reported that dialysis care continued, all major functions had been restored, and a notification process for potentially involved people and regulators began on August 1, 2025. The company also reported effects on billing, revenue collection, and patient census.
In its 2025 annual report, DaVita said relevant business functions had been restored and patient care continued throughout the incident and response. It again reported exfiltration of personal and protected health information and an adverse effect on billing and revenue collection. Those disclosures establish important facts, but they do not identify every affected record or explain the specific security control that failed.
Why this matters for healthcare
Healthcare organizations depend on both reliable systems and sensitive information. When an incident disrupts administrative or clinical support systems, teams must continue essential services while investigating what happened. DaVita's filings describe that tension directly: the company used contingency plans and continued care while restoring functions and assessing the data involved.
The later data disclosure matters for a separate reason. People potentially affected by an incident need accurate information about what the organization has confirmed and what steps are available to them. Early estimates, attacker claims, and assumptions about data types should not be presented as established facts while an investigation is still underway.
Practical lessons for security teams
DaVita's disclosures support several general incident-response lessons. These are recommendations drawn from the reported sequence, not findings about which safeguards DaVita did or did not have:
Plan for continuity before an incident. Identify services that must keep running, the systems they depend on, and the manual or alternate processes teams can use during disruption.
Separate response from certainty. Contain the event and communicate what is known, while clearly identifying what remains under investigation. Update the public record as findings change.
Prepare for a data investigation as well as system restoration. Restoring operations and determining which information was taken are different tasks. Each needs an owner, evidence, and a communication plan.
Account for business-process effects. The incident's impact may extend to billing, scheduling, notification, and support work even when essential care continues.
Closing thought
The public record of this incident changed over time. DaVita's initial filing described encryption and operational disruption, with the full impact unknown. Later filings reported exfiltration of personal and protected health information and the start of notifications. For healthcare security leaders, the useful lesson is to build continuity and investigative capacity together, then communicate with the precision the evidence allows.