DaVita, Cornerstone and Alta Hit by Ransomware

DaVita, Cornerstone Behavioral Healthcare and Alta Orthopaedics reported data breaches tied to ransomware attacks in the United States. Nutex Health was also added to The Gentlemen’s leak site, and the group claimed the incident as a double extortion case. Separately, DaVita is facing legal fallout from an April 2025 attack attributed to Interlock that affected about 2.7 million people and has already led to at least ten lawsuits.

What is known about DaVita?

DaVita agreed to a preliminary settlement in a class action after the April 2025 attack attributed to Interlock, which MedTech Dive said affected about 2.7 million people and cost the company $25 million in 2025. The company operates more than 2,600 outpatient kidney dialysis centers in the United States.

Benzinga also reported that the settlement class grew to about 2.3 million current and former patients after ten lawsuits were consolidated. MedTech Dive said the case had already prompted at least ten legal actions.

What happened at Cornerstone Behavioral Healthcare?

Cornerstone Behavioral Healthcare told patients that the attacker first gained access on May 26, 2026, and that the intrusion was stopped in about an hour. The company believes that less than 10% of the data on the affected computers and servers was encrypted.

An initial review estimated that the PHI of about 2,830 patients may have been compromised. Cornerstone later added an appointment reminder log and raised the total to 14,830 potentially affected people.

The company received a ransom demand but did not pay. It also wiped the affected devices, bought new ones and reviewed its security policies and procedures. In its notice, the company said it reported the incident to HHS OCR.

What data did Alta Orthopaedics expose?

Alta Orthopaedics said the compromised information could include names, contact details, Social Security numbers, government ID numbers, passports, financial account information, dates of birth, login credentials, diagnoses, treatments, prescriptions, billing codes, insurance data and biometric data.

The review of the affected data was completed on June 24, 2026. The clinic offered 24 months of credit monitoring and identity theft protection, and said notification letters were mailed to affected individuals.

HIPAA Journal reported that the INC Ransom group claimed responsibility for the incident and said it exfiltrated 26 GB of data.

Where does Nutex Health fit in?

Nutex Health was added to the leak site of the The Gentlemen group, which claimed responsibility for the attack and described it as a double extortion case. The reference comes from Morningstar, in a PR Newswire note about an Edelson Lechtzin LLP investigation into the theft of patient and employee data.