# DaVita Settles $15M Class Action Over Interlock Ransomware Breach Affecting 2.7M Patients

> Dialysis provider DaVita agreed to pay $15 million to settle a consolidated federal class action (Jenkins, et al. v. DaVita Inc., D. Colorado, No. 1:25-cv-01358-SBP) over an April 2025 Interlock ransomware double-extortion attack that compromised the data of 2,689,826 individuals. The court granted preliminary settlement approval on August 21, 2026, with a final approval hearing scheduled for 2027.

- **Published:** 2026-09-04T00:00:00Z
- **Last reviewed:** 2026-09-04T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2328
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-interlock-davita-ransomware-settlement-tl-2026-2328.webp?v=b9377d24 (Threadlinqs threat intel: Interlock Ransomware: DaVita Breach & $15M Settlement (TL-2026-2328) — High severity, 21 IOCs, 9 detection rules.)
- **ID:** TL-2026-2328
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** RESOLVED
- **Actor:** Interlock
- **Detections:** 9 (1 shown free below) · **IOCs:** 21

## Description

On March 24, 2025, the Interlock ransomware group gained unauthorized access to the network of DaVita Inc., a Denver-based dialysis and kidney care provider operating 2,675 outpatient centers across the United States and holding roughly 37% of the U.S. dialysis market. The intrusion went undetected for roughly three weeks until DaVita identified anomalous activity on April 12, 2025, activated its incident response plan, and proactively disconnected affected network segments, eradicating the threat actor from its environment the same day it was discovered. DaVita disclosed the incident via SEC Form 8-K on April 14, 2025, and publicly announced it on April 18, 2025.

Interlock employed its characteristic double-extortion model: exfiltrating data before deploying ransomware to encrypt files on portions of DaVita's network, primarily affecting laboratory database infrastructure. When DaVita did not pay the ransom, the group began publishing the stolen data on its Tor-based dark web leak site starting April 24-25, 2025, claiming to have exfiltrated roughly 1.5 TB (spanning over 683,000 files and 75,000 folders, individual folders ranging from 55 MB to over 1 TB), including internal documents, spreadsheets, and screenshots of sensitive records. DaVita's investigation, reported to the HHS Office for Civil Rights breach portal on August 1, 2025 and finalized around August 22, 2025, confirmed that 2,689,826 individuals were affected, making it one of the largest healthcare data breaches reported in 2025. Compromised data included patient names, addresses, dates of birth, Social Security numbers, health insurance information, dialysis lab test results and other health/clinical information, tax identification numbers, and in limited cases images of checks written to DaVita. Patient care reportedly continued uninterrupted throughout the incident; DaVita separately disclosed roughly $13.5 million in Q2 2025 incident costs ($12.5M remediation, $1.0M increased patient-care costs) against a reported total 2025 cost of the incident of about $25 million.

On July 22, 2025, CISA, the FBI, HHS, and MS-ISAC jointly published advisory AA25-203A (#StopRansomware: Interlock), documenting the group's TTPs from investigations through June 2025: initial access via drive-by downloads (malicious payloads disguised as fake Chrome/Edge browser updates or fake security-software updates for products such as FortiClient, Ivanti, GlobalProtect, Webex, and Cisco Secure Client) and ClickFix-style social engineering that tricks users into pasting and executing Base64-encoded PowerShell via the Windows Run dialog; deployment of a credential stealer (cht.exe) and keylogger (klg.dll, logging to conhost.txt); persistence via Startup-folder entries or a registry Run key disguised as a 'Chrome Updater' that re-executes a RAT on every logon; credential theft via browser credential dumping and Kerberoasting against domain accounts; lateral movement via RDP, AnyDesk, PuTTY, and cracked ScreenConnect instances; data staging and exfiltration to attacker-controlled Azure Blob Storage via Azure Storage Explorer and AzCopy, or alternatively via WinSCP; and file encryption using a 64-bit AES/RSA binary (conhost.exe) that appends .interlock or .1nt3rlock extensions and drops a !__README__!.txt ransom note (delivered via Group Policy Object) directing victims to a Tor .onion negotiation site, with no upfront ransom figure stated. It is not publicly confirmed which specific initial-access vector was used against DaVita; the TTPs above reflect Interlock's documented pattern of operations across its victim set generally, not DaVita-specific forensic disclosure.

The breach generated at least ten separate class-action lawsuits against DaVita, consolidated in the U.S. District Court for the District of Colorado as Jenkins, et al. v. DaVita Inc. (Case No. 1:25-cv-01358-SBP), alleging negligence, breach of implied contract, unjust enrichment, breach of fiduciary duty, invasion of privacy, and state consumer-protection violations. On August 21, 2026, the court granted preliminary approval of a $15 million settlement: $10 million earmarked for class-member relief (claims of up to $2,500 for documented losses, with a projected average payout of roughly $50 per claimant depending on response rates), with the remainder covering attorneys' fees, administrative costs, and service awards. DaVita denied all liability and wrongdoing. A final settlement approval hearing is scheduled for 2027.

## MITRE ATT&CK

- T1204.004 User Execution: Malicious Copy and Paste
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1078.002 Valid Accounts: Domain Accounts
- T1036.005 Match Legitimate Resource Name or Location
- T1218.011 System Binary Proxy Execution: Rundll32
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1056.001 Input Capture: Keylogging
- T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting
- T1082 System Information Discovery
- T1021.001 Remote Services: Remote Desktop Protocol
- T1530 Data from Cloud Storage
- T1219 Remote Access Tools
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Interlock Post-Exploitation — cht.exe/klg.dll Credential Theft, Chrome Updater Persistence, and Kerberoasting** (`TL-2026-2328-SPL-002`)

Detects the Interlock post-exploitation toolset documented in CISA AA25-203A: the cht.exe credential-stealer, the klg.dll keylogger (which writes captured keystrokes to conhost.txt), a Registry Run key disguised as 'Chrome Updater' used to re-launch the Interlock RAT on every logon, and Kerberoasting via RC4-encrypted TGS ticket requests (EventCode 4769, encryption type 0x17) against domain service accounts.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1547.001, T1036.005, T1555.003, T1056.001, T1558.003
- **Data sources:** sysmon, windows_security, microsoft_defender_deviceprocessevents, microsoft_defender_deviceregistryevents, microsoft_defender_devicefileevents
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
(index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=1 OR EventCode=7 OR EventCode=11 OR EventCode=13) earliest=-24h)
 OR (index=wineventlog sourcetype="WinEventLog:Security" EventCode=4769 earliest=-24h)
| eval detection_reason=case(
    EventCode=1 AND match(Image, "(?i)\\\\cht\.exe$"), "interlock_credential_stealer_cht_exe",
    (EventCode=1 OR EventCode=7) AND match(lower(Image." ".ImageLoaded." ".CommandLine), "klg\.dll"), "interlock_keylogger_klg_dll",
    EventCode=11 AND match(TargetFilename, "(?i)conhost\.txt$"), "interlock_keylog_output_file",
    EventCode=13 AND match(TargetObject, "(?i)\\\\Run(Once)?\\\\.*Chrome Updater"), "interlock_chrome_updater_persistence",
    EventCode=4769 AND (EncryptionType="0x17" OR Ticket_Encryption_Type="0x17"), "kerberoasting_rc4_tgs_request",
    1==1, null())
| where isnotnull(detection_reason)
| stats count min(_time) as first_seen max(_time) as last_seen by ComputerName, User, Account_Name, Service_Name, Image, TargetFilename, TargetObject, detection_reason
| sort -last_seen
```

### Microsoft KQL

```kql
union
(DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "cht.exe" or ProcessCommandLine has "klg.dll"
| project Timestamp, DeviceName, AccountName, Artifact=FileName, Detail=ProcessCommandLine, DetectionReason=iif(FileName =~ "cht.exe", "interlock_credential_stealer_cht_exe", "interlock_keylogger_klg_dll")),
(DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName =~ "conhost.txt"
| project Timestamp, DeviceName, AccountName=RequestAccountName, Artifact=FileName, Detail=FolderPath, DetectionReason="interlock_keylog_output_file"),
(DeviceRegistryEvents
| where Timestamp > ago(24h)
| where ActionType == "RegistryValueSet" and RegistryValueName has "Chrome Updater"
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, Artifact=RegistryKey, Detail=RegistryValueData, DetectionReason="interlock_chrome_updater_persistence"),
(SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4769 and TicketEncryptionType == "0x17"
| project Timestamp=TimeGenerated, DeviceName=Computer, AccountName=TargetUserName, Artifact=ServiceName, Detail=strcat("client=", Client), DetectionReason="kerberoasting_rc4_tgs_request")
| order by Timestamp desc
```

### Sigma

```yaml
title: Interlock Ransomware Persistence via Fake Chrome Updater Registry Run Key
id: 3d4e5f6a-7b8c-4d9e-af01-2b3c4d5e6f7a
status: experimental
description: Detects creation or modification of a Registry Run/RunOnce key value named 'Chrome Updater', a known Interlock ransomware persistence mechanism documented in CISA AA25-203A used to re-execute the Interlock RAT on every user logon.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-203a
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-04
tags:
    - attack.persistence
    - attack.t1547.001
    - attack.defense_evasion
    - attack.t1036.005
    - attack.credential_access
    - attack.t1555.003
    - attack.t1056.001
    - attack.t1558.003
    - attack.tool.interlock
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|contains:
            - '\Software\Microsoft\Windows\CurrentVersion\Run\'
            - '\Software\Microsoft\Windows\CurrentVersion\RunOnce\'
    selection_name:
        TargetObject|contains: 'Chrome Updater'
    condition: selection and selection_name
falsepositives:
    - None expected — "Chrome Updater" is not a name used by Google's legitimate signed update mechanism (GoogleUpdate.exe / gupdate service)
level: high
```

**Known false positives:**

- Kerberoasting alerts alone can fire on legitimate service-account authentication in environments still using RC4 for compatibility with legacy applications — correlate with volume/burst of distinct SPNs requested by a single account
- Third-party software occasionally ships oddly-named helper binaries; verify file hash/signature before treating a cht.exe or klg.dll hit as confirmed malicious

**Tuning notes:** For the Kerberoasting leg, tune on a per-account TGS-request burst threshold (e.g. >=5 distinct SPNs in 10 minutes) rather than single-event RC4 requests to cut noise from legacy applications; hash-pin cht.exe/klg.dll detections once a confirmed sample is captured to reduce reliance on filename alone, since Interlock is known to rename artifacts across campaigns.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Interlock ClickFix — Base64 PowerShell Pasted via Run Dialog / Fake Browser Update Lure (locked: unlock with TL Creds)
- Interlock Post-Exploitation — cht.exe/klg.dll Credential Theft, Chrome Updater Persistence, and Kerberoasting (locked: unlock with TL Creds)
- Interlock C2/Lateral Movement — RMM Tool Abuse, Cobalt Strike/SystemBC Beaconing, and Azure Blob/WinSCP Exfiltration (locked: unlock with TL Creds)
- ClickFix Base64-Encoded PowerShell Execution via Run Dialog (Interlock Pattern) (locked: unlock with TL Creds)
- Interlock Ransomware Persistence via Fake Chrome Updater Registry Run Key (locked: unlock with TL Creds)
- Interlock Ransomware Post-Compromise RMM Abuse and Cloud Storage Staging/Exfiltration (locked: unlock with TL Creds)
- Interlock ClickFix — Base64 PowerShell Pasted via Run Dialog / Fake Browser Update Lure (locked: unlock with TL Creds)
- Interlock C2/Lateral Movement — RMM Tool Abuse, Cobalt Strike/SystemBC Beaconing, and Azure Blob/WinSCP Exfiltration (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [DaVita Agrees to Pay $15 Million to Settle Data Breach Litigation](https://www.hipaajournal.com/davita-data-breach-settlement/)
- [DaVita agrees to pay $15M to settle claims from data breach](https://www.healthcaredive.com/news/davita-agrees-to-pay-15m-to-settle-claims-from-data-breach/829445/)
- [#StopRansomware: Interlock (AA25-203A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-203a)
- [DaVita Confirms 2.7 Million Individuals Affected by Ransomware Attack](https://www.hipaajournal.com/davita-ransomware-attack/)
- [Interlock Ransomware Group Claims DaVita Attack, Leaks Over 1.5 TB of Data](https://cyberinsider.com/interlock-ransomware-group-claims-davita-attack-leaks-over-1-5-tb-of-data/)
- [Interlock ransomware gang started leaking data allegedly stolen from leading kidney dialysis firm DaVita](https://securityaffairs.com/176946/cyber-crime/interlock-ransomware-gang-started-leaking-data-allegedly-stolen-from-leading-kidney-dialysis-firm-davita.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2328