Kettering Health’s Cyber Siege: Unraveling the Silent Attack on Hospitals

Summary

• Kettering Health, a hospital system based in Dayton, Ohio, was hit by a cyberattack that disrupted its operations.
• The attack was identified as ransomware, affecting patient care and putting data at risk.
• The FBI and outside security firms were brought in to help respond.
• The outage shows how exposed hospitals remain to determined attackers.

A hospital system goes offline

Kettering Health, which runs hospitals and clinics across the Dayton area, suffered a system-wide technology outage on May 20, 2025 after a cyberattack that reached its medical centers across southwest Ohio and forced staff back to paper. Phones went down too. Other hospital systems are watching closely, because most of them run on the same kind of connected records and scheduling systems.

Ransomware inside the network

The attack was identified as ransomware. Attackers got into the hospital system’s network and encrypted data. Services that staff rely on every day stopped working. Hospital leaders had to switch from running patient care to running an incident response.

Local authorities and the FBI worked with security specialists on the response. The biggest worry was patient data: whether it had been stolen, and whether it might be misused.

Care on paper

The damage went beyond Kettering’s own systems. Elective procedures were canceled, emergency services faced delays, and staff fell back on manual processes while key technology was down. Every extra step on paper slows care.

Hospitals now run on interconnected systems. When those systems fail, the clinical side feels it within minutes.

Lessons for other hospitals

Other hospital systems will use Kettering’s experience to check their own plans. Many have never tested what happens if records and phones fail at the same moment.

Hospital leaders are putting more money into security, but tools alone do not solve it. Staff need training to spot phishing, report problems quickly and keep working when systems go dark.

Working with outside agencies

Hospitals are sharing more information with security firms and government agencies after attacks like this one. The aim is to spot similar intrusions sooner and respond faster.

Kettering has said it is working with authorities and outside cybersecurity consultants to restore systems and protect patient information.

What hospital boards should take from it

Kettering Health’s outage shows that a hospital’s cyber defenses are part of patient safety. Records and imaging depend on systems that attackers know how to break. So does the schedule.

Boards should ask three questions this quarter. How long can we run on paper? When did we last test restoring from backups? Who calls the FBI, and when?

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.