F500 Pharma & Health Services · Health Care: Medical Facilities · Data breach
DaVita
Headline
The 2025 DaVita ransomware breach is among the largest healthcare incidents of that year, and the population affected makes it distinct…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
The 2025 DaVita ransomware breach is among the largest healthcare incidents of that year, and the population affected makes it distinct: dialysis patients typically attend treatment three times a week, indefinitely, and cannot pause care while a provider recovers. There is also very little competitive alternative - dialysis in the US is a near-duopoly, and clinic availability is geographically constrained. So the two ordinary consumer responses to a provider's failure, switching and waiting, are both unavailable to exactly the patients affected here.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected for individual patient agreements.
Data sharing
ONE OF THE LARGEST HEALTHCARE RANSOMWARE BREACHES OF 2025, affecting a genuinely vulnerable patient population: attackers (claimed by the Interlock ransomware group; DaVita did not confirm the group) accessed DaVita's dialysis-labs database (unauthorized access began March 24, 2025, detected April 12, 2025), ultimately confirmed to affect 2,689,826 INDIVIDUALS — among kidney-dialysis patients specifically, a population managing serious chronic illness. Exposed data included names, addresses, birthdates, Social Security numbers, driver's license/government ID numbers, financial information, HEALTH INSURANCE DETAILS, MEDICAL/TREATMENT INFORMATION, actual DIALYSIS LAB TEST RESULTS, and (for a smaller subset) tax ID numbers and IMAGES OF PERSONAL CHECKS written to DaVita. Interlock claimed to have stolen about 1.5 TB (roughly 700,000 files) and posted it on its leak site in late April 2025. Multiple class actions were filed within weeks (April-May 2025).
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy davita.com/legal/privacy-policy | Not fetched yet | NO (HTML only) |
| Terms of service davita.com/legal/terms-of-use | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.