Kettering Health Faith-Based Hospital System Breach (2025): 1.7M Patient & Employee Records Including Medical, SSN & Financial Data Exposed

About Kettering Health

Kettering Health is a not-for-profit, faith-based (Adventist) integrated health system in western Ohio, operating roughly 14 hospitals and more than 120 outpatient sites. It provides emergency, surgical, imaging, pharmacy, and outpatient care using the Epic electronic health record, maintaining extensive patient clinical, insurance, and billing records as well as employee HR and payroll data.

Why They Hold Your Data

Integrated health systems collect patient identity, contact, insurance, billing, appointment, and clinical records across hospitals, specialty care, and administrative operations.

Recent Developments

A May 20, 2025 ransomware attack caused a system-wide outage; Kettering restored core Epic functions by early June and declared normal operations on June 13, 2025. It initially reported a placeholder of 501 affected individuals to HHS in July 2025, then confirmed the total at 1,695,382 and began mailing patient notifications in early 2026. A class-action lawsuit was filed in Montgomery County in June 2025.

Data Points Exposed

Breach Impact

The breach compromised a broad set of clinical, identity, and financial data (medical records, mental-health notes, medication lists, Social Security numbers, insurance, and payment/banking data) for roughly 1.7 million patients, plus HR/payroll and ID-document data for employees. The scale and sensitivity create severe medical-fraud, identity-theft, financial-fraud, and extortion risk, compounded operational disruption to patient care, and generated significant litigation and reputational exposure.

Exploitation & Downstream Threats

• Medical identity fraud and insurance abuse using clinical, medication, and insurance data | • Identity theft and synthetic identity construction using SSN, DOB, and ID documents | • Financial fraud using exposed payment-card/banking data | • Extortion using mental-health notes and sensitive diagnoses | • Employee-directed HR/payroll fraud and social engineering | • Targeted phishing/vishing and fraudulent medical-bill scams | • Doxxing and physical targeting from exposed home addresses

What You Should Do

1. Freeze credit at all three bureaus and monitor for new-account and tax-refund fraud.
2. Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
3. Watch for medical-benefit fraud and health-themed phishing that references real provider relationships.
4. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
5. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).