Cyberattack Paralyzes Kettering Health, Forces Cancellation of Surgeries

Kettering Health cancels procedures after cyberattack

• Kettering Health suffered a system-wide technology outage caused by a cyberattack on May 20, 2025.
• Elective inpatient and outpatient procedures were canceled.
• Emergency rooms stayed open, though some ambulances were diverted.
• The Interlock ransomware group was later confirmed behind the attack.

Kettering Health, a network of hospitals and outpatient centers in the Dayton, Ohio area, was hit by a cyberattack on May 20, 2025 that caused a system-wide technology outage. This article looks at what happened, how Kettering responded and what other hospitals can take from it.

What shut down at Kettering

The outage hit Kettering’s network of hospitals and outpatient facilities across southwest Ohio. Elective inpatient and outpatient procedures were canceled. Patients waiting for surgery had to wait longer.

Paper processes and delays

With its electronic systems down, staff switched to manual processes such as paper records, which slowed everything. Kettering warned the public about delays and said urgent and emergency cases came first. Its call center was also affected.

How Kettering responded

Kettering kept the public informed through regular updates, though early on it did not say what kind of attack it was. Kettering later confirmed the Interlock ransomware group was behind it. Core functions of its Epic electronic health record were restored on June 2, and the system said normal operations resumed by mid-June.

Why hospitals keep getting hit

Hospitals hold large amounts of patient data and cannot tolerate downtime, which makes them attractive to ransomware gangs. Kettering is one of many health systems hit in recent years. Each outage raises the same question about how well hospitals can keep caring for patients when their systems go dark.

Patient data at risk

Attacks like this disrupt care and can also expose patient records. Interlock is known for stealing data before encrypting systems, so patient information is often at risk in these incidents. That’s why regulators and patient groups are pushing for stronger protections.

Lessons for other health systems

Kettering’s full costs are still being counted. Every health system can learn from it, because the stakes include patient safety as well as data.

Planning for downtime

Security has to be part of hospital strategy, not an add-on. That means investing in monitoring, staff training and tested backups, and practicing paper-based downtime procedures before they are needed.

Hospitals also benefit from sharing what they learn after an incident. Attackers reuse their methods. A tactic seen at one health system will likely show up at another.

For hospital leaders, Kettering is a reminder to ask a hard question now: how long could we keep treating patients if every system went down tomorrow?

Fred Templeton, CISA, CASP, SEC+

Fred Templeton is a practicing Information Systems Auditor in the Washington DC area. Fred works as a government contractor and uses his skills in cyber security to make our country's information systems safer from cyber threats. Fred holds a master's degree in cybersecurity and is currently working on his PHD in Information Systems.