Kettering Health Cyber-Attack Disrupts Services

Kettering Health, a major healthcare provider in western Ohio, US, is dealing with the aftermath of a systemwide outage caused by a cyber-attack.

The incident disrupted internal systems and forced the cancellation of elective inpatient and outpatient procedures across its 14 hospitals and over 120 facilities.

As of May 22, emergency services remain available, but patients face difficulties reaching the call center. The network confirmed the outage stemmed from unauthorized access to its systems and is under active investigation.

Cybersecurity firm PRODAFT attributed the attack to a threat actor known as Nefarious Mantis, part of the Interlock cluster. The group is known for targeting US healthcare organizations and deploying ransomware after gathering intelligence inside the networks.

“Elective inpatient and outpatient procedures at Kettering Health facilities have been canceled for today,” the network said, adding that it will reschedule as updates become available.

Read more on ransomware trends in US healthcare: 14 Million Patients Impacted by US Healthcare Data Breaches in 2024

In addition to operational disruptions, Kettering Health patients have reported receiving scam calls requesting credit card payments.

While it’s unclear if the calls are linked to the attack, the organization has temporarily suspended all billing-related phone outreach.

“The fact that miscreants captured targets for fraudulent outbound collections calls makes me wonder about dwell time,” said Trey Ford, chief information security officer at Bugcrowd.

“This is a strong and worrying variation of double-extortion ransomware attacks.”

Community Response and Ongoing Recovery

Kettering Health is continuing to evaluate procedures on a case-by-case basis. First responders were also advised to reroute patients when necessary.

Despite the disruption, regional hospitals and public health agencies are coordinating efforts to ensure care continues.

Ford praised the hospital’s decision-making, saying that “Cancelling outpatient and elective procedures to prioritize acute care […] is absolutely the right move.”

Patients are urged to remain cautious of unsolicited calls.

“Do not make payments or give up sensitive information on inbound calls,” Ford warned.

“With personal, medical and financial information now compromised, the risk for identity theft, medical fraud and targeted phishing attacks is high,” warned Keeper Security CEO Darren Guccione.

“While there may not be immediate signs of misuse, the stolen data could surface down the road, prolonging risks for both individuals and organizations. To protect against these threats, individuals should regularly monitor their financial accounts, medical records and healthcare statements for any signs of suspicious activity.”

Kettering Health reminded the public it will not be contacting patients for payments until further notice.

Image credit: Ray Geiger / Shutterstock.com