Cyber Surgeons: Ohio Hospital Network Crippled by Ransomware Attack

Cyber Surgeons: Ohio Hospital Network Crippled by Ransomware Attack

Summary

• Kettering Health Hit: A ransomware attack caused a system-wide outage at the Ohio health system.
• Patient Care Impact: Critical systems went down, and elective procedures were canceled.
• Ransomware Confirmed: The outage was caused by ransomware, part of a wider wave of attacks on healthcare.
• Response and Mitigation: Kettering Health is working with security experts to restore services.

The attack

A ransomware attack has knocked out systems across Kettering Health, a hospital network based in the Dayton, Ohio, area. The outage hit on May 20, 2025, and disrupted care across the region. In health care, a computer outage can quickly become a patient safety problem.

The outage

How far it reached

Kettering Health runs hospitals and clinics across western Ohio. On Tuesday morning a system-wide technology outage took down the systems used for patient intake, care and electronic medical records. Media reports linked it to the Interlock ransomware group.

Patient care disrupted

Kettering Health canceled elective inpatient and outpatient procedures. Its emergency departments stayed open, but ambulances were diverted to other hospitals, including Premier Health’s Miami Valley Hospital, which took in patients during the outage. Phone lines and scheduling were also affected.

Ransomware in health care

Ransomware gangs target hospitals because downtime puts lives at risk. That raises the pressure to pay.

The human factor

Staff are often the first line of defense. Phishing remains a common way in, so training and strong access controls matter as much as technology.

Recovery

Recovery from an attack like this takes weeks, not days. Kettering Health says it is working with outside security experts to restore systems safely, and it activated downtime procedures to keep caring for patients in the meantime.

What to watch

Watch how long Kettering’s systems stay down and whether patient data was stolen. Hospitals in the region will also study how their diversion plans held up under real load, since the next outage could hit any of them.

The lesson

Hospitals need tested downtime plans and offline backups. This attack shows why.

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.