Three weeks after the Interlock ransomware attack on May 20, 2025, Kettering Health has affirmed the resumption of normal operations for important healthcare services. Kettering Health has been issuing frequent updates on the development being made to reestablish its systems, stating that the primary functions of its Epic EHR system were back on June 2, 2025, which permitted patient data entry and the input of a backlog of information manually recorded on paper.
When the attack was discovered, Kettering Health immediately terminated Interlock’s access to its network and system. On June 5, 2025, it was confirmed that all tools and persistence mechanisms of the ransomware group were removed from its systems. Moreover, all systems were completely updated with the most recent versions of software and patches. Security improvements were applied, which included network segmentation, improved monitoring, and up-to-date access controls. Kettering Health mentioned it is positive that its cybersecurity system and workforce HIPAA security training are enough to mitigate future risks.
The main goal throughout the incident response is to provide quality patient care while keeping all network-linked devices safe and connections with its partners protected. Kettering Health mentioned that the main emphasis has now changed from protecting systems to making sure that patient support systems and booking systems are completely functional.
On June 9, 2025, Kettering Health announced having limited access to MyChart and patients can see their upcoming visits, book appointments, see prescriptions and get refills, check test results, and communicate with providers. All surgical procedures had likewise started again. On June 10, 2025, Kettering Health reported the complete restoration of MyChart access, the start of normal operations for a few important services, such as imaging, surgery, doctor office appointments, and retail pharmacy, and the working telephone lines.
The restoration process is not yet finished. The data analysis is still in progress to ascertain the scope of data theft. There is no estimate yet regarding the number of people impacted. Personal notification letters will be sent to the impacted people immediately, including details regarding the provided fraud protection and credit monitoring services.
