Ransomware Group Interlock Linked to Cyberattack on Kettering Health

Kettering Health, an Ohio-based health system, believes ransomware group Interlock was behind a May 20 cyberattack that caused widespread system outages and disrupted patient care. Elective procedures were canceled, and ambulances were diverted during the initial response.

Kettering has since removed the malware, reviewed its systems, and implemented new security updates. Core parts of its Epic electronic health record were restored in early June.

Interlock, an emerging threat group, has previously targeted healthcare and other critical sectors, according to Cisco Talos.

Ransomware attacks—where access to data is blocked until a ransom is paid—have increasingly impacted healthcare, delaying care, straining operations, and, in some cases, contributing to increased patient mortality. Kettering continues recovery efforts amid growing concern over cybersecurity in the medical field.

11-06-2025