Cybersecurity Risks in Healthcare: Lessons From the Kettering Health Attack

When people think about the legal risk of a cyberattack on a healthcare organization, they usually think about stolen data. The Kettering Health attack in 2025 is a useful reminder that the bigger exposure can come from something else: weeks of disrupted care. A year and a half later, the Ohio health system faces a data breach class action and hundreds of individual lawsuits from patients who say their treatment was delayed.

This guide walks through what happened, what the lawsuits claim, and what smaller practices can take from it.

What happened at Kettering Health

Kettering Health is a Dayton-area health system with 14 medical centers. Based on HIPAA Journal's timeline of the incident, drawn from the system's own updates and its breach report:

April 9, 2025: The attackers first got into the network, according to the later investigation.
May 20, 2025: The attack was detected. A system-wide outage hit all 14 medical centers and the call center. Scheduled inpatient and outpatient procedures were canceled and staff switched to paper records.
May 21 and May 30, 2025: Kettering Health warned patients about scam calls, texts and emails, including callers asking for credit card payments for medical bills.
June 2, 2025: Core parts of the Epic electronic health record were restored.
June 5, 2025: The Interlock ransomware group claimed the attack and posted Kettering Health on its leak site, claiming to have stolen 941 GB of data. That figure is the attackers' claim and has not been independently confirmed.
June 10, 2025: Surgery, imaging, retail pharmacy and physician office visits resumed normal operations, and the MyChart patient portal was fully restored.
July 21, 2025: The breach was reported to HHS's Office for Civil Rights with a placeholder count.

The OCR breach portal now lists 1,695,382 people affected. Affected individuals were offered complimentary credit monitoring and identity theft protection.

So the attackers were inside for about six weeks before detection, and core clinical systems were down for roughly three weeks.

The lawsuits

Two kinds of claims followed, and the difference matters.

The data breach class action. Filed in June 2025 in the Montgomery County Court of Common Pleas, it alleges Kettering Health failed to protect patient data and did not follow regulatory guidance or industry cybersecurity practices. This is the familiar pattern after almost any large breach.

The care disruption suits. These are newer and larger in number. The Dayton Daily News reported in March 2026 that more than 200 related suits had been filed, described by plaintiffs' counsel as mass torts. They allege that the outage delayed or disrupted care: canceled appointments, delayed diagnostic tests, interrupted prescriptions and delayed cancer screenings. HIPAA Journal reported that 44 of these suits were consolidated into a single complaint in the same court, with claims including negligence, gross negligence, emotional distress and breach of contract.

Kettering Health has said it does not comment on pending litigation. These are allegations, and as of this update we found no settlement or ruling on the merits.

The lesson for owners: a ransomware event can create liability for what happens to patients while systems are down, not only for the records that leak.

Why healthcare stays a target

The industry's cost numbers explain part of it. IBM's 2026 Cost of a Data Breach Report, released in July 2026, put the average healthcare breach at $6.64 million, still the highest of any industry, though down 10.5% from the prior year's $7.42 million. Across all industries, the 2026 report found 39% of organizations said they had been hit by ransomware.

The operational picture explains the rest. Clinics depend on scheduling, records, e-prescribing and phones being up every day. When those stop, pressure to restore quickly is intense, which is exactly the pressure ransomware groups count on.

What the breach rules say about ransomware

Under the HIPAA Breach Notification Rule, an impermissible use or disclosure of protected health information is presumed to be a breach unless the organization shows a low probability of compromise through a documented risk assessment. That assessment looks at the type of information, who got it, whether it was actually acquired or viewed, and how far the risk was mitigated.

OCR's ransomware guidance, issued in 2016, takes the position that a ransomware attack will usually result in a breach, and that the determination is fact specific. Encryption the organization applied before the attack can change the analysis, because properly encrypted data may not count as "unsecured" information.

When notice is required, it goes to affected individuals without unreasonable delay and no later than 60 days after discovery, with media notice for breaches affecting more than 500 residents of a state and timing rules for reporting to HHS. Business associates have their own duty to notify the covered entity within the same outer limit. State breach laws can add requirements.

Current HIPAA penalty amounts

If OCR investigates and finds violations, civil penalties are set by culpability tier. The current figures come from the inflation adjustment published January 28, 2026, which HHS confirmed on October 21, 2026 will stay in place because there is no 2026 adjustment.

Culpability tier	Per violation	Calendar year cap
Did not know	$145 to $73,011	$2,190,294
Reasonable cause	$1,461 to $73,011	$2,190,294
Willful neglect, corrected within 30 days	$14,602 to $73,011	$2,190,294
Willful neglect, not corrected	$73,011 to $2,190,294	$2,190,294

Under a 2019 Notice of Enforcement Discretion, HHS said it would apply lower annual caps for the first three tiers: $25,000, $100,000 and $250,000 before inflation adjustment, with $1.5 million for the top tier.

What smaller practices can take from Kettering

A solo practice or med spa is not a 14-hospital system, but the same failure points show up at every size. Businesses reviewing their ransomware readiness often look at:

Downtime procedures. How do you check patients in, see the schedule, reach patients and handle prescriptions if your EHR and phones are down for two weeks? Write it down and print it.
Patient communication. Kettering's scam warnings show attackers and fraudsters use the confusion. Have a plan for telling patients what you will and will not ask them for.
Backups you have tested. Keep backups that are separate from the main network, and actually try restoring from them.
Multi-factor authentication on email, remote access and every cloud system holding patient data.
Detection. Kettering's attackers were inside for weeks. Ask your IT provider who would notice unusual activity, and how fast.
Vendor list. Know which vendors hold patient data, whether Business Associate Agreements are in place where required, and how each vendor would tell you about an incident.
A current risk analysis. OCR's enforcement in 2025 focused heavily on whether organizations had an accurate, up-to-date risk analysis.
Counsel and insurer contacts. Know who you call first, and check what your cyber policy requires of you after an incident.

None of this is legal advice about what your practice is required to do. It is a list of the questions the Kettering timeline raises.

Where NutriCove fits

NutriCove builds AI automation for medical offices, including receptionist, missed-call text back, follow-up and booking systems. Because those tools can touch patient information, our medical page notes that GoHighLevel needs its HIPAA add-on and a signed Business Associate Agreement before protected health information goes in. We do not provide cybersecurity, legal or HIPAA compliance services. If you are mapping which tools in your office handle patient data, see how we set up automation for medical offices.

Sources

This article is general information, not legal or medical advice. Talk to a qualified attorney or licensed professional about your situation.