DaVita Settles $15M Class Action Over Interlock Ransomware Breach Affecting 2.7M Patients

Key facts for Interlock DaVita ransomware settlement

Detection coverage for Interlock DaVita ransomware settlement

As of 2026-09-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2328 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Interlock Post-Exploitation — cht.exe/klg.dll Credential Theft, Chrome Updater Persistence, and Kerberoasting

Detects the Interlock post-exploitation toolset documented in CISA AA25-203A: the cht.exe credential-stealer, the klg.dll keylogger (which writes captured keystrokes to conhost.txt), a Registry Run key disguised as 'Chrome Updater' used to re-launch the Interlock RAT on every logon, and Kerberoasting via RC4-encrypted TGS ticket requests (EventCode 4769, encryption type 0x17) against domain service accounts.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1547.001, T1036.005, T1555.003, T1056.001, T1558.003
• Data sources: sysmon, windows_security, microsoft_defender_deviceprocessevents, microsoft_defender_deviceregistryevents, microsoft_defender_devicefileevents
• Severity: critical
• Confidence: high

Splunk SPL

(index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=1 OR EventCode=7 OR EventCode=11 OR EventCode=13) earliest=-24h)
 OR (index=wineventlog sourcetype="WinEventLog:Security" EventCode=4769 earliest=-24h)
| eval detection_reason=case(
    EventCode=1 AND match(Image, "(?i)\\\\cht\.exe$"), "interlock_credential_stealer_cht_exe",
    (EventCode=1 OR EventCode=7) AND match(lower(Image." ".ImageLoaded." ".CommandLine), "klg\.dll"), "interlock_keylogger_klg_dll",
    EventCode=11 AND match(TargetFilename, "(?i)conhost\.txt$"), "interlock_keylog_output_file",
    EventCode=13 AND match(TargetObject, "(?i)\\\\Run(Once)?\\\\.*Chrome Updater"), "interlock_chrome_updater_persistence",
    EventCode=4769 AND (EncryptionType="0x17" OR Ticket_Encryption_Type="0x17"), "kerberoasting_rc4_tgs_request",
    1==1, null())
| where isnotnull(detection_reason)
| stats count min(_time) as first_seen max(_time) as last_seen by ComputerName, User, Account_Name, Service_Name, Image, TargetFilename, TargetObject, detection_reason
| sort -last_seen

Microsoft KQL

union
(DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "cht.exe" or ProcessCommandLine has "klg.dll"
| project Timestamp, DeviceName, AccountName, Artifact=FileName, Detail=ProcessCommandLine, DetectionReason=iif(FileName =~ "cht.exe", "interlock_credential_stealer_cht_exe", "interlock_keylogger_klg_dll")),
(DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName =~ "conhost.txt"
| project Timestamp, DeviceName, AccountName=RequestAccountName, Artifact=FileName, Detail=FolderPath, DetectionReason="interlock_keylog_output_file"),
(DeviceRegistryEvents
| where Timestamp > ago(24h)
| where ActionType == "RegistryValueSet" and RegistryValueName has "Chrome Updater"
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, Artifact=RegistryKey, Detail=RegistryValueData, DetectionReason="interlock_chrome_updater_persistence"),
(SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4769 and TicketEncryptionType == "0x17"
| project Timestamp=TimeGenerated, DeviceName=Computer, AccountName=TargetUserName, Artifact=ServiceName, Detail=strcat("client=", Client), DetectionReason="kerberoasting_rc4_tgs_request")
| order by Timestamp desc

Sigma

title: Interlock Ransomware Persistence via Fake Chrome Updater Registry Run Key
id: 3d4e5f6a-7b8c-4d9e-af01-2b3c4d5e6f7a
status: experimental
description: Detects creation or modification of a Registry Run/RunOnce key value named 'Chrome Updater', a known Interlock ransomware persistence mechanism documented in CISA AA25-203A used to re-execute the Interlock RAT on every user logon.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-203a
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-04
tags:
    - attack.persistence
    - attack.t1547.001
    - attack.defense_evasion
    - attack.t1036.005
    - attack.credential_access
    - attack.t1555.003
    - attack.t1056.001
    - attack.t1558.003
    - attack.tool.interlock
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|contains:
            - '\Software\Microsoft\Windows\CurrentVersion\Run\'
            - '\Software\Microsoft\Windows\CurrentVersion\RunOnce\'
    selection_name:
        TargetObject|contains: 'Chrome Updater'
    condition: selection and selection_name
falsepositives:
    - None expected — "Chrome Updater" is not a name used by Google's legitimate signed update mechanism (GoogleUpdate.exe / gupdate service)
level: high

Known false positives:

• Kerberoasting alerts alone can fire on legitimate service-account authentication in environments still using RC4 for compatibility with legacy applications — correlate with volume/burst of distinct SPNs requested by a single account
• Third-party software occasionally ships oddly-named helper binaries; verify file hash/signature before treating a cht.exe or klg.dll hit as confirmed malicious

Tuning notes: For the Kerberoasting leg, tune on a per-account TGS-request burst threshold (e.g. >=5 distinct SPNs in 10 minutes) rather than single-event RC4 requests to cut noise from legacy applications; hash-pin cht.exe/klg.dll detections once a confirmed sample is captured to reduce reliance on filename alone, since Interlock is known to rename artifacts across campaigns.

• 🔒 Interlock ClickFix — Base64 PowerShell Pasted via Run Dialog / Fake Browser Update Lure · unlock with TL Creds
• 🔒 Interlock Post-Exploitation — cht.exe/klg.dll Credential Theft, Chrome Updater Persistence, and Kerberoasting · unlock with TL Creds
• 🔒 Interlock C2/Lateral Movement — RMM Tool Abuse, Cobalt Strike/SystemBC Beaconing, and Azure Blob/WinSCP Exfiltration · unlock with TL Creds
• 🔒 ClickFix Base64-Encoded PowerShell Execution via Run Dialog (Interlock Pattern) · unlock with TL Creds
• 🔒 Interlock Ransomware Persistence via Fake Chrome Updater Registry Run Key · unlock with TL Creds
• 🔒 Interlock Ransomware Post-Compromise RMM Abuse and Cloud Storage Staging/Exfiltration · unlock with TL Creds
• 🔒 Interlock ClickFix — Base64 PowerShell Pasted via Run Dialog / Fake Browser Update Lure · unlock with TL Creds
• 🔒 Interlock C2/Lateral Movement — RMM Tool Abuse, Cobalt Strike/SystemBC Beaconing, and Azure Blob/WinSCP Exfiltration · unlock with TL Creds

Indicators of compromise for Interlock DaVita ransomware settlement

As of 2026-09-04, Threadlinqs Intelligence tracks 21 indicators of compromise for TL-2026-2328.

How Interlock DaVita ransomware settlement works

The court granted preliminary settlement approval on August 21, 2026, with a final approval hearing scheduled for 2027.

On March 24, 2025, the Interlock ransomware group gained unauthorized access to the network of DaVita Inc., a Denver-based dialysis and kidney care provider operating 2,675 outpatient centers across the United States and holding roughly 37% of the U.S. dialysis market. The intrusion went undetected for roughly three weeks until DaVita identified anomalous activity on April 12, 2025, activated its incident response plan, and proactively disconnected affected network segments, eradicating the threat actor from its environment the same day it was discovered. DaVita disclosed the incident via SEC Form 8-K on April 14, 2025, and publicly announced it on April 18, 2025.

Interlock employed its characteristic double-extortion model: exfiltrating data before deploying ransomware to encrypt files on portions of DaVita's network, primarily affecting laboratory database infrastructure. When DaVita did not pay the ransom, the group began publishing the stolen data on its Tor-based dark web leak site starting April 24-25, 2025, claiming to have exfiltrated roughly 1.5 TB (spanning over 683,000 files and 75,000 folders, individual folders ranging from 55 MB to over 1 TB), including internal documents, spreadsheets, and screenshots of sensitive records. DaVita's investigation, reported to the HHS Office for Civil Rights breach portal on August 1, 2025 and finalized around August 22, 2025, confirmed that 2,689,826 individuals were affected, making it one of the largest healthcare data breaches reported in 2025. Compromised data included patient names, addresses, dates of birth, Social Security numbers, health insurance information, dialysis lab test results and other health/clinical information, tax identification numbers, and in limited cases images of checks written to DaVita. Patient care reportedly continued uninterrupted throughout the incident; DaVita separately disclosed roughly $13.5 million in Q2 2025 incident costs ($12.5M remediation, $1.0M increased patient-care costs) against a reported total 2025 cost of the incident of about $25 million.

On July 22, 2025, CISA, the FBI, HHS, and MS-ISAC jointly published advisory AA25-203A (#StopRansomware: Interlock), documenting the group's TTPs from investigations through June 2025: initial access via drive-by downloads (malicious payloads disguised as fake Chrome/Edge browser updates or fake security-software updates for products such as FortiClient, Ivanti, GlobalProtect, Webex, and Cisco Secure Client) and ClickFix-style social engineering that tricks users into pasting and executing Base64-encoded PowerShell via the Windows Run dialog; deployment of a credential stealer (cht.exe) and keylogger (klg.dll, logging to conhost.txt); persistence via Startup-folder entries or a registry Run key disguised as a 'Chrome Updater' that re-executes a RAT on every logon; credential theft via browser credential dumping and Kerberoasting against domain accounts; lateral movement via RDP, AnyDesk, PuTTY, and cracked ScreenConnect instances; data staging and exfiltration to attacker-controlled Azure Blob Storage via Azure Storage Explorer and AzCopy, or alternatively via WinSCP; and file encryption using a 64-bit AES/RSA binary (conhost.exe) that appends .interlock or .1nt3rlock extensions and drops a !__README__!.txt ransom note (delivered via Group Policy Object) directing victims to a Tor .onion negotiation site, with no upfront ransom figure stated. It is not publicly confirmed which specific initial-access vector was used against DaVita; the TTPs above reflect Interlock's documented pattern of operations across its victim set generally, not DaVita-specific forensic disclosure.

The breach generated at least ten separate class-action lawsuits against DaVita, consolidated in the U.S. District Court for the District of Colorado as Jenkins, et al. v. DaVita Inc. (Case No. 1:25-cv-01358-SBP), alleging negligence, breach of implied contract, unjust enrichment, breach of fiduciary duty, invasion of privacy, and state consumer-protection violations. On August 21, 2026, the court granted preliminary approval of a $15 million settlement: $10 million earmarked for class-member relief (claims of up to $2,500 for documented losses, with a projected average payout of roughly $50 per claimant depending on response rates), with the remainder covering attorneys' fees, administrative costs, and service awards. DaVita denied all liability and wrongdoing. A final settlement approval hearing is scheduled for 2027.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021.001 Remote Services: Remote Desktop Protocol

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1218.011 System Binary Proxy Execution: Rundll32

Credential Access

T1056.001 Input Capture: Keylogging; T1555.003 Credentials from Password Stores: Credentials from Web Browsers; T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1204.004 User Execution: Malicious Copy and Paste

Privilege Escalation

T1078.002 Valid Accounts: Domain Accounts

Discovery

T1082 System Information Discovery

Command and Control

T1219 Remote Access Tools

Collection

T1530 Data from Cloud Storage

Persistence

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Exfiltration

T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

Impact

T1657 Financial Theft

Remediation for Interlock DaVita ransomware settlement

Patches

• Prioritize patching internet-facing systems and known exploited vulnerabilities per the CISA KEV catalog

Immediate actions

• Isolate and disconnect affected network segments to contain lateral movement, as DaVita did on April 12, 2025
• Reset credentials for all domain and privileged accounts observed or suspected to be compromised, including hunting for Kerberoasting activity
• Hunt for known Interlock artifacts across the estate: cht.exe, klg.dll, conhost.txt, .interlock/.1nt3rlock encrypted files, and !__README__!.txt ransom notes

Workarounds

• Train users to recognize ClickFix-style fake CAPTCHA prompts and fake browser/security-software update lures used by Interlock for initial access
• Restrict or allowlist remote access/administration tools (AnyDesk, ScreenConnect, PuTTY) to prevent abuse for lateral movement and persistence

Longer-term hardening

• Deploy DNS filtering and web-access firewalls to block drive-by-download and malicious fake-update infrastructure
• Implement phishing-resistant MFA on all critical, remote-access, and administrative services
• Enforce network segmentation between clinical/laboratory systems and corporate IT
• Deploy EDR tooling on all endpoints, servers, and virtual machines, including laboratory infrastructure
• Maintain offline, encrypted, immutable backups and regularly test restoration procedures
• Audit and enforce least privilege on administrative and domain accounts to reduce Kerberoasting exposure

Affected and fixed versions

• DaVita Inc. — DaVita dialysis and laboratory network infrastructure
  Vulnerable versions: Network environment accessed by Interlock actors March 24 - April 12, 2025
  Fixed in: Threat actor eradicated and affected network segments remediated as of April 12, 2025

Timeline of Interlock DaVita ransomware settlement

• 2025-03-24 locked-ioc-14 ransomware actors gain unauthorized access to DaVita's network; the intrusion goes undetected for roughly three weeks
• 2025-04-12 DaVita detects the ransomware activity, activates incident response protocols, proactively disconnects affected network segments, and eradicates the threat actor from its environment the same day
• 2025-04-14 DaVita discloses the cybersecurity incident via SEC Form 8-K filing
• 2025-04-18 DaVita publicly announces the ransomware incident
• 2025-04-24 locked-ioc-14 ransomware group publicly claims responsibility and begins publishing roughly 1.5 TB of stolen DaVita data on its Tor dark web leak site after ransom demands go unmet
• 2025-07-22 CISA, FBI, HHS, and MS-ISAC jointly publish advisory AA25-203A (#StopRansomware: locked-ioc-14), detailing the group's TTPs and IOCs from investigations through June 2025
• 2025-08-01 DaVita reports the breach to the HHS Office for Civil Rights breach portal
• 2025-08-22 DaVita finalizes confirmation that 2,689,826 individuals were affected, ranking the incident among the largest healthcare data breaches reported in 2025
• 2026-08-21 U.S. District Court for the District of Colorado grants preliminary approval of the $15 million class settlement in Jenkins, et al. v. locked-ioc-11 (No. 1:25-cv-01358-SBP)
• 2026-09-02 Settlement terms are publicly reported, including the $15M total, $10M class-relief allocation, and claims of up to $2,500 per documented loss

Sources cited for Interlock DaVita ransomware settlement

• #StopRansomware: Interlock (AA25-203A) CISA · Government advisory · 2025-07-22
• DaVita Agrees to Pay $15 Million to Settle Data Breach Litigation hipaajournal.com · News · 2026-09-01
• DaVita agrees to pay $15M to settle claims from data breach healthcaredive.com · News · 2026-09-02
• DaVita Confirms 2.7 Million Individuals Affected by Ransomware Attack hipaajournal.com · News · 2025-08-22
• Interlock Ransomware Group Claims DaVita Attack, Leaks Over 1.5 TB of Data cyberinsider.com · News · 2025-04-25
• Interlock ransomware gang started leaking data allegedly stolen from leading kidney dialysis firm DaVita securityaffairs.com · News · 2025-04-25

Threats related to Interlock DaVita ransomware settlement

• Winona County, Minnesota Pays $128,539.57 Ransom After January 2026 Ransomware Attack With Data Theft
• MCBS Ransomware Data Breach: PEAR Extortion Group Exposes PII and Health Records of 1.26 Million Individuals Across Seven Healthcare Clients
• The Gentlemen RaaS (GOLD SHERWOOD / hastalamuerte): FortiGate/VPN Intrusion Chain, GentleKiller BYOVD EDR Killers, and Rclone Exfiltration
• Mistic Backdoor (MLTBackdoor) Impersonates Microsoft Endpoint Security via DLL Sideloading — Woodgnat/KongTuke Access Broker