The scammers’ window: patient communication when a hospital goes dark

The week

On May 20, 2025, Kettering Health, a nonprofit health system with hospitals and outpatient facilities around Dayton, Ohio, reported a system-wide technology outage caused by a cyberattack, later confirmed as ransomware. The system runs 14 medical centers and more than 120 outpatient locations across western Ohio, so the outage touched a large share of the region’s care.

Suppose you were one of its patients in late May. Your knee surgery has just been canceled. The hospital’s phone line is jammed. Then your phone rings, and a polite caller says he is from Kettering Health and needs a credit card payment to settle your bill. It sounds plausible. It is a scam, and something very like it happened to Kettering’s patients.

Ransomware is malicious software that criminals slip into an organization’s network. Once inside, it scrambles (encrypts) files and systems so they cannot be used, and the attackers demand payment for the key to unscramble them. Increasingly, they also copy data out first and threaten to publish it. Local press reported that the attackers had threatened to publish patient data if Kettering did not negotiate within 72 hours.

The effects at Kettering were immediate. The health system canceled elective inpatient and outpatient procedures. Its call center, the main phone line patients use to reach it, was affected. Emergency departments stayed open, but ambulances were diverted to other hospitals for a time. Clinicians moved to “downtime procedures,” the paper-based backup routines hospitals keep for when computers fail: handwritten orders, paper charts and runners carrying information between departments.

Then came the twist that makes this week worth studying. On May 21, the day after the outage began, Kettering warned that scammers were calling patients, claiming to be Kettering staff and asking for credit card payments for medical bills. The health system said it would not call patients to request or take payments by phone until further notice, and it suspended its own routine bill-payment calls. Criminals had spotted that the hospital had gone silent and stepped into the gap.

The warnings widened as the outage went on. On May 30, Kettering’s chief executive urged patients and staff not to click links or open attachments in messages claiming to come from the system. He also urged them to hang up on suspicious calls and report them to police. By then the impersonation had spread from phone calls to texts and email.

In early June, a criminal group called Interlock claimed responsibility and began publishing data it said it had stolen. The group claimed to hold hundreds of thousands of files, and trade press reported that the leaked material included images of driver’s licenses and passports and business documents. Kettering said it had removed the attackers’ tools from its network.

Kettering’s own updates were posted on its public website and carried by local press. On June 3, its chief executive confirmed that attackers had accessed data belonging to some patients, without giving a number. Two days later, Kettering said it had reason to believe Interlock was responsible. It also said it had segmented its network and patched vulnerabilities. Each of those statements arrived while patients were still waiting for the portal and the phone lines to return.

Kettering restored its Epic electronic health record on June 2, about two weeks after the attack began. An electronic health record, or EHR, is the central computer system that holds patients’ charts, orders, medications and test results; Epic is one of the most widely used. Getting it back is the moment a hospital starts to feel normal again. The patient portal and inbound and outbound calling took longer, coming back over the following week or so.

The attack landed on a sector still absorbing two larger ones. In February 2024, ransomware at Change Healthcare, a claims and payments clearinghouse owned by UnitedHealth Group, disrupted billing and pharmacy transactions nationwide. In May 2024, an attack on Ascension left its hospitals working on paper for weeks. Both attacks had shown that recovery is measured in weeks, and that the effects reach patients and partners who were never breached. Health system leaders knew outages could last that long. Fewer had planned how to speak to patients while they did.

The malware mattered less than what followed: the hospital lost its voice at the exact moment patients most needed to hear from it, and someone else filled the gap.

Most writing about hospital ransomware focuses on clinical operations: ambulances diverted to other hospitals, paper downtime procedures and the long road back to the electronic health record. Those matter enormously. But the Kettering Health attack exposed something less discussed and, for many organizations, easier to fix. The moment a health system goes silent, someone else starts talking to its patients. In this case it was criminals asking for card payments.

Outage communication is usually filed under public relations. It belongs under security. It has four separate design problems, and each needs a decision before any attack: the channels that survive, the answers patients need, the impersonation that follows, and the authority to speak. Each is owned by a different team, which is why they are so often left undone.

We start with why hospital communication fails all at once, then take the four problems in order. We close with what silence costs, what a well-run first hour looks like and what to settle before the next outage.

What breaks when ransomware hits a hospital

A hospital can lose its voice suddenly because of the way its technology hangs together. A modern health system is less a set of separate computers than a web of connected services that lean on each other.

At the center sits the electronic health record, or EHR. It is the digital chart: every diagnosis, medication, allergy, appointment and test result. Around it are dozens of other systems that borrow its data. The scheduling system knows who is coming in tomorrow. The billing system knows who owes what. The patient portal, the website or app where patients see results and message their doctors, reads straight from the EHR.

Underneath all of that is the internal network, the private plumbing that connects the organization’s computers. Alongside it runs an identity system, the digital front desk that checks who you are when you log in and decides what you may open. Most organizations use one identity system for nearly everything, so that staff have a single username and password. That is convenient on a normal day. On a bad day it means one compromised front desk can lock every door at once.

Ransomware attackers know this. Their aim is usually to reach the identity system and spread across the internal network before triggering the encryption, so that as much as possible stops working at the same time. Security teams often respond by deliberately shutting down more systems to contain the damage. Either way, the result is the same: a large share of the organization’s technology goes dark together.

Many of the tools a hospital uses to talk to patients depend on that same plumbing. When the plumbing fails, the tools fail with it, often without anyone having realized they were connected.

Attackers arrive long before the outage

Encryption is the last step of an attack, not the first. Interlock’s methods, as later described by federal agencies, included tricking users into running malicious code through fake browser updates and fake verification prompts. From that foothold, attackers typically spend weeks mapping the network, collecting passwords and copying data before they encrypt anything.

That long stay matters for communication. By the time systems go dark, the attackers may hold administrator rights in email, the website’s management console or the call center platform. A channel that is technically still running may not be safe to use. If attackers control the hospital’s email domain, a message sent from it may be indistinguishable from one they send themselves.

So a surviving channel needs two properties. It must keep working without the internal network, and its administrator accounts must be separate enough that an attacker inside the network cannot reach them.

Containment cuts the cord from both ends

Outages also spread outward. When a health system announces an attack, partners often disconnect their own links to it until they are confident the threat is contained. After the Change Healthcare attack in 2024, many organizations cut connections as a precaution. Laboratories, pharmacies, payers and referral partners may all stop exchanging data with the victim for a time.

The hospital’s own security team does the same internally. It may shut down email, remote access and the call center software while it investigates. Those are sound containment choices. They also remove the communication tools that a plan written for a power failure or a storm would assume are available.

Shared platforms widen the blast

The structure of the organization matters too. Many smaller hospitals and physician groups use an EHR hosted by a larger health system, an arrangement Epic calls Community Connect. When the host is attacked, affiliated organizations can lose their records and their portal at the same moment, though they were never breached themselves.

Ambulatory networks and physician groups often depend on a single practice management vendor for scheduling, reminders and billing. A county hospital may share its network and email with the rest of county government. Each arrangement means the communication plan has to account for systems the organization does not run.

The channels that survive

A modern health system reaches patients through its portal, automated reminders by text and phone, email, a central call center and its website. Many of those depend on the same infrastructure ransomware takes down. The portal is tied to the EHR. Reminder systems pull from scheduling. Call center software may authenticate against the internal directory, meaning agents log in through the same identity system that has just been locked. When the attack hits, the system loses most of its voice at once.

Planning starts with a channel inventory that records, for each channel, what it depends on: the internal network, the corporate identity system, corporate email, the EHR. Channels that depend on none of those survive. Typical survivors are:

• A website hosted outside the internal network, for example with an outside web hosting company, so it stays up when the hospital’s own servers are down.
• Verified social media accounts, whose passwords and recovery details do not run through corporate email.
• Local broadcast media, which can carry a short message to a whole region within hours.
• A cloud call center platform, meaning phone software run by an outside provider over the internet, with its own administrator accounts protected by separate multifactor authentication. Multifactor authentication is the second check after a password, such as a code on a phone, and “separate” here means it does not rely on the hospital’s locked identity system.

A pre-registered mass texting service, with patient contact lists exported on a schedule to an off-network store, closes the largest gap. The idea is simple. Once a week, say, a copy of patients’ names and mobile numbers is saved somewhere outside the hospital’s network. If the network is lost, the communications team can still text every scheduled patient within the hour. Without that copy, the texting service is useless, because the list it needs is locked inside the encrypted systems.

Texting needs registration before the emergency

Business texting in the United States does not work on demand. Carriers require organizations that send texts through software platforms to register their brand and the purpose of their messages before sending at volume. Registration takes days to weeks. A health system that tries to set up mass texting during an outage will find its messages filtered or blocked.

Consent is a second question. Automated texts to mobile phones fall under the Telephone Consumer Protection Act. The Federal Communications Commission has allowed certain healthcare messages under specific conditions, but the conditions are narrow. Counsel should confirm in advance which outage messages fit, and the patient intake process should collect consent for urgent operational messages.

Phone numbers and caller ID

The main phone number is the channel patients know best. If the call center platform is down, the number can still be forwarded to a backup service, but only if someone with authority over the carrier account can do it. That person needs credentials that do not live in the encrypted network. Many organizations discover that the carrier account is tied to a corporate email address that no longer works.

A short recorded message on the main number is one of the most valuable things a hospital can provide in the first hour. It can say what is open, what is postponed, how patients will be contacted and what the hospital will not ask for. It reaches every patient who calls, including those without smartphones.

The off-network contact list is protected health information

A list of patients’ names, phone numbers and appointment times is protected health information under HIPAA. Storing it outside the network creates a second copy that must be secured. The vendor holding it needs a business associate agreement, the HIPAA contract that binds service providers to protect patient data.

The list should hold the minimum needed: name, mobile number, preferred language, next appointment date, site and service line. Diagnoses and clinical detail do not belong in it. The decryption key must live somewhere other than the identity system that may be locked. The communications lead and a deputy should be able to reach it with credentials kept offline.

The trade-off is real. A second copy of patient data is another place it can leak. The alternative, having no way to reach patients when systems fail, carries risks of its own, including the fraud Kettering’s patients faced. Most organizations will judge the narrow, well-protected copy worth having, but the decision should be recorded with its reasoning.

Each survivor should be tested in an exercise that assumes the internal network and corporate email are both gone. That last condition is the one that catches people out. Many plans assume, without saying so, that someone can send an email to get things started.

One afternoon’s tabletop exercise

Suppose a regional health system’s communications director runs a tabletop exercise. She asks each channel owner one question: if our network and email were gone at 6 a.m. tomorrow, could you reach patients by 9 a.m.? The portal team says no; the portal reads from the EHR. The reminder vendor says yes, but only with a contact list they do not hold. The website team discovers that the site’s administrator logins run through the corporate identity system. Within an afternoon, the health system knows which three things to fix, and none of them is expensive.

How the answer differs by organization

A large health system can afford a dedicated texting platform and a hosted website with separate administration. An independent physician group usually cannot, but it has fewer patients and often a practice management vendor that offers outage messaging. It can ask that vendor whether reminders will keep working if the practice’s own network is down.

A critical access hospital, the small rural facility type defined under Medicare, may rely almost entirely on a host system’s technology. Its plan should be written jointly with the host. A county or public hospital may find that its website and social media accounts belong to the county. It needs an agreement on who can post for the hospital during an incident.

The answers patients need

Patients in an outage ask predictable questions. They want to know whether their surgery is still on, whether to go to the emergency department and how to refill a prescription. They ask where to go for dialysis or infusion, and whether to pay the bill that arrived last week. When nobody answers, patients guess, call repeatedly, show up at the wrong site or drop out of care. Every one of those outcomes costs money, strains staff and, for some patients, creates clinical risk.

Because the questions are predictable, the answers can be drafted in advance. A set of pre-approved messages for the first 72 hours should cover scheduled procedures, emergency care, prescriptions, high-dependency services such as oncology and dialysis, billing, and how the health system will contact patients. Each message needs blanks for dates and sites and a named clinical reviewer. Without them, communications staff write from scratch while clinical leaders run operations, and messages arrive late or contradict each other across sites.

The drafts work like an airline’s safety briefing: written, checked and approved long before the emergency, and simply read out on the day.

Different patients, different messages

One general statement will not serve everyone. The pack should separate at least five audiences:

• Patients with scheduled procedures, who need to know whether to come in and how they will hear about rescheduling.
• Patients in active treatment, such as chemotherapy, dialysis, high-risk pregnancy and transplant follow-up, who cannot wait two weeks and need a named route to care.
• People deciding whether to seek emergency care, who must hear that emergency departments remain open, if they do, and that they should call 911 in an emergency.
• Caregivers and families of admitted patients, who need visiting and contact arrangements.
• Referring physicians and emergency medical services, who need operational detail patients do not.

The patients in active treatment are the highest priority and the hardest to reach. Their lists often live in specialty systems inside the network. A separate, regularly refreshed roster for those programs, held by the service line leader, is worth more than any general message.

Cadence and version control

Patients cope better with uncertainty when they know when the next update will come. A fixed schedule, such as updates at 9 a.m. and 5 p.m. daily, cuts repeat calls. Each statement should carry a date and time, and older versions should stay visible with a note that they have been replaced. Contradictions between an old social post and a new website update are a common source of confusion, and scammers exploit confusion.

Some answers depend on other organizations. Patients told to fill prescriptions elsewhere need pharmacies that can reach them. Patients redirected for imaging or infusion need receiving sites that expect them. Agreements with neighboring hospitals, retail pharmacies and the regional emergency medical services coordinator should include a shared statement each partner can post. When a patient hears the same message from the hospital, the pharmacy and the local ambulance service, trust goes up and phone traffic goes down.

Regional healthcare coalitions, the planning groups funded through the federal Hospital Preparedness Program, are a natural place to agree those statements. They already coordinate hospitals, emergency medical services and public health for disasters. Adding a cyber outage scenario to their exercises costs little.

The drafts also need translation into the languages the patient population uses, done in advance rather than during the outage. Translation in the middle of a crisis is slow and error-prone, and the patients who most need clear guidance are often the ones least able to piece it together from fragments.

The rules already ask for a plan

Hospitals that take part in Medicare already have to maintain an emergency preparedness program under the Centers for Medicare & Medicaid Services conditions of participation. That program must include a communication plan and regular exercises. Many of those plans were written with storms, floods and power failures in mind. They assume email, the internal phone system and the patient portal will work. A cyberattack is the scenario in which those assumptions fail together, and the plan should be tested against it.

The impersonation that follows

Criminals watch the news. A public outage tells them that patients are confused, that normal channels are down and that a call claiming to come from the hospital will be hard to check. A request to settle a balance or update a card on file sounds plausible in ordinary times. During an outage, patients have no way to verify it. That is exactly the window the Kettering scammers exploited.

This kind of fraud is called impersonation or, when it happens by phone, “vishing” (voice phishing). Phishing is the familiar trick of sending a message that pretends to come from someone trusted in order to steal money or information. It does not require any hacking skill at all. It only requires confidence, a phone and a believable story, and an outage supplies the story.

Why it needs no stolen data

A health system serves a region. A scammer who calls phone numbers in that region at random will reach many of its patients without knowing anything about them. The news coverage supplies the context, and a spoofed caller ID that shows the hospital’s name or a local number supplies credibility. The scam is cheap to run, which is why it can begin within a day.

If data was stolen, impersonation gets more convincing, because the caller may know the patient’s name, appointment and physician. A caller who says “I’m calling about your procedure with your surgeon on Thursday” sounds very much like the real thing. At Kettering, the leaked material reportedly included ID images, which can support fraud long after the outage ends.

The channels multiply over time. Kettering’s warnings moved from calls in the first days to calls, texts and emails by the end of May. Text messages with payment links and lookalike websites are cheap to produce. A domain one letter different from the hospital’s own can host a convincing payment page within hours.

The defense is a short list of things the health system will not do during the outage, published on day one. A typical list would say:

• We will not call you to request card payments.
• We will not ask for your insurance details by text.
• We will not send you links to new payment sites.

Pausing outbound billing statements and collections calls for the outage makes that promise true and easy to explain. It costs some short-term cash flow, but it gives patients a rule they can actually use: any request for money right now is fake. The list should name one verification route, such as a published callback number on the surviving website. Front-line staff need the same script, so patients who call in hear a consistent answer.

Kettering’s public warning that it was not making such calls was the right instinct, and its decision to suspend its own payment calls made the warning credible. The goal is to make that warning automatic, pre-written and published in the first hours rather than days.

Measures beyond the warning

A few further steps reduce the scammers’ yield:

• Register lookalike domains in advance, or monitor for new ones, and have a takedown process agreed with a registrar or a brand protection service.
• Brief the call center and front desks to log every reported scam call with the number shown, the time and the script used. The pattern helps police and carriers.
• Tell local police and the public where to report. Kettering advised patients to report scam calls to law enforcement. The FBI’s Internet Crime Complaint Center and the Federal Trade Commission also take reports.
• Extend the grace period. A promise that no account will go to collections and no late fee will apply for a set period after restoration removes the urgency scammers rely on.

The same trick aimed at staff

Patients are not the only targets of impersonation during an outage. During recovery, IT teams reset thousands of passwords and re-enroll devices, often by phone. A caller claiming to be a clinician locked out of a system is entirely plausible. The federal health sector’s cybersecurity coordination center warned in 2024 about attackers social-engineering IT help desks in healthcare. Recovery runbooks should require in-person or video verification for privileged resets, even when that slows restoration.

The authority to speak

All of this depends on deciding who speaks for the health system when its normal structures are disrupted. Most hospitals organize emergencies under an incident command structure, a standard way of running a crisis with clear roles borrowed from emergency services, including a public information officer who handles outward messages.

Plans often name that officer but not a deputy, an approval path that works without email, or rules that let individual sites post local updates within agreed limits. Communication then stalls while people seek approval through channels that no longer work. If the officer is on vacation and every sign-off normally happens by email, nothing goes out.

Approval without email

An approval path that works without email needs three things. It needs a contact sheet on paper and on personal phones, with mobile numbers for the incident commander, the public information officer, the deputy, the chief medical officer and counsel. It needs an out-of-band messaging tool set up in advance, with accounts not tied to the corporate identity system. And it needs a rule on what counts as approval, such as a named approver’s reply in that tool, so nobody waits for a signature.

Site-level authority matters in a large system. A hospital 40 miles from headquarters may need to post a local parking or entrance change within minutes. Pre-agreed limits, such as operational changes yes and statements about the attack no, let sites act without bottlenecking the center.

Authority also needs a prior agreement with counsel and the cyber insurer on what can be said before forensic work concludes. Forensic work is the detailed investigation of what the attackers did and what they took, and it can take weeks. Caution about the attack itself is reasonable. Statements about data theft carry legal weight under HIPAA, the federal health privacy law, and under state breach laws, which set rules for telling people when their information has been exposed.

Why statements about data take longer

Under the HIPAA breach notification rule, an unauthorized acquisition of patient data is presumed to be a reportable breach unless a risk assessment shows a low probability that the data was compromised. Covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more people must also be reported to HHS within that window, and to prominent media in affected states.

Those rules explain a pattern patients find frustrating. Early statements are cautious, and the first count filed with HHS can be a placeholder that later grows. A health system that says “no evidence of data theft” on day two, and then confirms theft, loses credibility it will need for practical messages. Counsel and the insurer’s breach response team are right to slow those statements.

That caution should not extend to practical patient guidance, which can flow from the first hour. “Your Thursday appointment is postponed; we will text you a new date” says nothing about the attack. Separating the two message types in advance, with different approvers, removes the most common cause of delay. Exercises should rehearse this split alongside clinical downtime drills, so the people approving messages have practiced doing it without their laptops.

Different organizations, different speakers

An academic medical center may share a communications office with its university, which has its own approval habits and its own lawyers. A public hospital’s statements may be subject to public records laws and may need to align with county emergency management. A physician group may have no public information officer at all. In each case, the plan should name the person who will speak, the person who will stand in, and the outside parties who must be told before or soon after a statement goes out.

The cost of a silent hospital

Patient messaging carries as much money and risk as restoring clinical systems.

Customers. Patients who are defrauded during an outage do not blame the scammer alone. They remember that the hospital left them guessing. Loyalty in healthcare is built over years and can be dented in a week.

Money. Missed appointments, duplicate calls and patients who show up at the wrong site all carry real operating costs. Clear early messages reduce call volume when the call center itself may be impaired. Pausing collections has a cost too, but billing is usually disrupted anyway while systems are down. A pause adds little to the cash-flow hit and buys a clear anti-fraud message.

Regulators and lawyers. Messages that contradict each other, or that say too much too early about data, can create legal exposure. A pre-agreed split between practical guidance and attack statements reduces that risk. Communication failures that delay care can also become claims in their own right, separate from the data breach.

Staff. Front-line staff absorb patient anger when there is no script. A clear script protects them and keeps them consistent. Staff also need their own channel. A nurse who learns of a site closure from local television has been failed by the plan.

Reputation. Local media will cover the outage regardless. The organization that speaks early, clearly and usefully shapes the story; the one that stays silent lets others shape it.

The case against, and why it mostly fails

Four objections come up when health systems discuss this work.

The first is that speaking early invites litigation. That risk applies to statements about the attack and data, which the split above keeps under counsel’s control. Telling patients that their appointment has moved creates little exposure, and silence creates its own.

The second is that patients ignore hospital texts, or will mistake a mass text for a scam. Both happen. The remedy lies in normal times: telling patients now which number or short code the hospital uses, and that it will never ask for payment by text. An outage message then arrives through a channel patients already recognize.

The third is that a mass text will flood the call center. It can, if every patient receives the same message at once. Staggering messages by appointment date and including the answer to the obvious question, whether to come in, keeps the follow-up calls manageable.

The fourth is that the money is better spent preventing the attack. Prevention deserves most of the budget. Communication preparation costs little by comparison, and no prevention program can promise the outage will not happen. The two compete for attention more than for funds.

The first hour, done well

A health system that has done this well can act within the first hour of a major outage. It can put a short holding statement on an externally hosted website and text every patient scheduled for the next three days. It can publish its “we will not ask you for” list and brief its call center agents and partner pharmacies from a pre-written pack. Not one of those steps requires the internal network.

The first 72 hours, in sequence

1. Hour one. Holding statement on the hosted website and social accounts. Recorded message on the main number. “We will not ask you for” list published. Outbound billing and collections paused.
2. Hours two to six. Texts to patients scheduled in the next three days, staggered. Personal calls from service lines to patients in active treatment. Shared statement sent to partner hospitals, pharmacies and emergency medical services.
3. Day one. Update schedule announced. Scam reporting route published. Staff briefing through the out-of-band channel.
4. Days two and three. Rescheduling messages as clinical leaders confirm capacity. First counsel-approved statement about the investigation, saying only what is known.

What to measure

A few measures show whether the plan worked, in exercises and in a real event. They include the time from declaring the incident to the first public statement, and the share of scheduled patients reached before their appointment. Call abandonment on the main number, scam reports received and acted on, and the number of patients who arrived for canceled appointments complete the set. Tracking them in exercises gives a baseline, and an auditor or board can see the trend.

The ways it goes wrong are easy to recognize once named:

• Hidden dependencies. The website, social accounts or texting service turn out to need corporate email or the corporate login to operate.
• Stale contact lists. The off-network copy was set up once and never refreshed, so it misses recent patients.
• Single points of authority. One named spokesperson, no deputy and an approval path that runs through email.
• Merged messages. Practical guidance waits for legal sign-off on statements about the attack, so patients hear nothing.
• Billing on autopilot. Automated statements and collection calls keep going, which makes a fake payment request harder to spot.
• Untested plans. The plan exists on paper, stored on a shared drive that is itself encrypted.

What to settle before the next outage

• If our internal network and corporate email disappeared at 6 a.m., which channels could we use to reach patients by 9 a.m., and when was our off-network copy of patient contact details last refreshed?
• Do we have pre-approved messages for the first 72 hours, translated into the languages our patients use, with a named clinical reviewer for each?
• Who can post our list of things we will never ask patients for during an outage, and who can pause outbound billing and collections calls, on day one?
• Who is our public information officer, who is the deputy, how do they approve messages without email, and have counsel and our cyber insurer agreed in advance which messages need their review?
• Do our partner hospitals and pharmacies have a shared statement ready to post, and when did we last rehearse all of this alongside a clinical downtime drill?

These questions need no technical answer to be useful. A clear “we don’t know” is itself valuable, because it shows where the work is.

Ownership is the last piece. The channel inventory belongs to IT and communications together. The message pack belongs to communications with clinical review. The impersonation playbook belongs to security and revenue cycle. Authority belongs to the incident commander and counsel. A single executive, often the chief operating officer, should own the whole and report on it to the board at least once a year.

With hindsight

Kettering Health restored Epic on June 2, 2025, and said it had resumed normal operations for key services by mid-June. The patient portal and the system’s phone lines and call centers were working again across the organization around June 10 and 11, roughly three weeks after the outage began. The Interlock group published data it claimed to have stolen, which turned an operational crisis into a longer-running privacy one.

On July 22, 2025, four bodies issued a joint advisory on Interlock: CISA (the federal Cybersecurity and Infrastructure Security Agency), the FBI, HHS (the Department of Health and Human Services) and the Multi-State Information Sharing and Analysis Center. The advisory described the group’s tactics and included specific guidance for healthcare organizations. Advisories like this are the government’s way of turning one victim’s experience into a checklist for everyone else, and they are worth a leader’s attention even when the named group never touches their organization.

The advisory said the group had been active since late September 2024. Its initial access methods included drive-by downloads from compromised legitimate websites, fake software updates and fake verification prompts that trick users into running commands. Those are attacks on people at their screens. They reinforce a theme of this article: the same human trust that scammers exploit after an outage is often how the outage begins.

By 2026 the HHS breach portal, the public list of large health data breaches, showed the incident as affecting about 1.7 million individuals. That made it one of the larger healthcare breaches of 2025. The path to that number illustrates the notification mechanics described above. According to the HIPAA Journal, Kettering first reported the breach to HHS in July 2025 with a placeholder count of 501, completed its file review in October 2025 and updated the count in 2026. It also offered affected individuals credit monitoring and identity protection.

The number is a reminder that a ransomware attack has two lives: the outage that everyone sees, and the data exposure that lingers for months in notifications, inquiries and patient worry.

There was a third life as well. The HIPAA Journal reported in March 2026 that dozens of lawsuits against Kettering had been consolidated in an Ohio state court. Many alleged delayed treatment or denial of care, rather than only data exposure. Whatever their merits, they show that the outage itself, and how patients were guided through it, can become a source of legal claims.

For other health systems, the most transferable part of the record is Kettering’s first ten days of public statements. A scam warning came on the second day, along with a suspension of its own payment calls, and a broader warning followed on May 30. Read in sequence, they show the impersonation moving from phones to texts and email as the outage lengthened. A plan written today should assume the same progression and pre-draft warnings for each channel.

The early warning about scam calls proved sound, and it has become a more common feature of hospital outage statements. Impersonation of trusted institutions by phone and text remained a growing fraud pattern across sectors, and criminals continued to use public outages as cover. Banks, utilities and government agencies face the same dynamic: whenever a trusted name goes silent, someone else will borrow it.

The underlying dependency is harder to fix. Portals, reminders and call centers commonly run on the same identity platform as everything else, because that is cheaper and easier to manage on normal days. Separating them is slow, unglamorous work, and it rarely wins budget until a neighbor has an outage.

Some health systems treat patient communication as part of incident response, with surviving channels and ready messages. They are better placed in the first days of an outage than those that treat it as public relations. Patient communication is one of the cheapest pieces of cyber resilience available. It needs a contact list stored in the right place, a few pages of pre-approved text, a deputy with authority and a rehearsal. Compared with rebuilding an EHR, that is a small investment, and it protects patients on the very first day.