Kettering Health Battles Cyber Intruders Amidst Growing Digital Threats

Summary

• Security Breach: Kettering Health, a hospital network in Ohio, was hit by a ransomware attack that caused a system-wide outage.
• Immediate Response: Staff switched to downtime procedures, and elective procedures were canceled.
• Industry Trend: The attack adds to a long run of ransomware hitting hospitals.
• Call to Action: The case shows why hospitals need tested backup plans and strong access controls.

Cyberattack Disrupts Care in Dayton

Kettering Health, which runs 14 medical centers in the Dayton, Ohio area, suffered a ransomware attack on May 20, 2025. The attack knocked out computer systems across the network. For patients, that meant canceled appointments and delays. For staff, it meant going back to paper.

The health system said it had canceled elective inpatient and outpatient procedures while it worked to restore systems, and its call center was also affected. Emergency rooms stayed open, though some ambulances were diverted.

A Pattern in Health Care

Kettering Health is far from alone. Ransomware attacks on hospitals have climbed over the past several years. A few factors keep driving them:

Attackers Go Where the Pressure Is

Hospitals cannot wait weeks to restore systems, which makes them more likely to pay. Ransomware crews usually get in through phishing, stolen passwords or unpatched remote-access tools, and attacks on shared vendors can hit many providers at once.

More Systems, More Openings

Hospitals now depend on electronic health records, connected medical devices and dozens of outside vendors. Each one adds a possible way in, and many hospital IT teams are small for the job.

Kettering Health’s Response

Kettering Health activated its downtime procedures, which let clinicians keep caring for patients using paper records. It also warned patients about scam calls from people pretending to be Kettering staff and asking for credit card payments for medical bills. The health system said it would not make such calls while systems were down.

What Hospitals Can Learn

Each new attack shows the same gaps. Hospitals need multi-factor authentication on remote access and email. They need patched internet-facing systems. Most of all, they need backups attackers cannot reach.

Prepare for Downtime

Downtime plans only work if staff have practiced them. Hospitals that run regular drills recover faster and keep patients safer during an outage.

Share What You Learn

Sharing threat information through groups such as Health-ISAC and with federal agencies helps other hospitals spot the same attackers early.

What Comes Next

The attack on Kettering Health is another reminder of how much damage ransomware can do in health care. Hospitals now run on software. Protecting that software is part of protecting patients. Recovery from attacks like this one can take weeks, and the lessons apply to every health system that has not been hit yet.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.