Kettering Health ransomware attack claimed by Interlock gang, 941GB stolen data

The Interlock gang on Wednesday has claimed the ongoing ransomware attack on Kettering Health, along with the nearly 1TB of data it alleges to have exfiltrated from the healthcare conglomerate.

Kettering Health’s network of more than 120 medical facilities, including nine major hospitals across Ohio, is still struggling to restore systems after first reporting the incident more than two weeks ago on May 20th.

Serving roughly 1.5 million patients per year in the Buckeye State, the system-wide outage forced the cancellation of thousands of patient procedures, while doctors and medical staff resorted to filling out paper forms by hand, patients reported.

Interlock, already suspected of carrying out the Kettering Health ransomware attack, posted the organization on its dark leak blog Wednesday afternoon.

The gang declared it has a massive 941GB cache of stolen data consisting of 732,490 files, providing six samples, which appear to be a financial revenue report, 2023 and 2024 budget reports, company insurance coverage documents, company tax ID information, an individual Ohio driver’s license, and another individual’s passport from Japan.

The gang also provides a breakdown of data available for download, including an 85.5MB “Bank Reports” file, a 7.7GB “Police Security Personnel” file, a 4.7GB file of alleged Medicaid Applications, as well as files titled “Blood Bank KH Main” and “PharmacySurgery.”

Kettering Health shared the ransom note signed by Interlock with the media when the attack first happened.

“Your network was compromised, and we have secured your most vital files,” the gang had written, according to CNN.

Cybernews, viewing Interlock’s leak site at the time, confirms that Kettering Health was not listed on the "Worldwide Secrets Blog," leading us to speculate that the medical network was trying to negotiate a ransom payment with the gang.

Well, those negotiations, if they happened at all, appear to have gone south.

Meantime, Kettering Health posted its 15th update on the system-wide outage Monday morning on its website, announcing a “major milestone in our broader restoration efforts and returning to normal operations.”

The non-profit healthcare network said it has successfully restored its Epic electronic health record (EHR) system with the help of nearly 200 employees and staff.

Progress also continues in bringing back online in- and outbound calling to Kettering Health facilities and practices, as well as MyChart for patients, the update said.