The Center for Kidney Care Data Breach: A Ransomware Claim, No Lawsuit Yet
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
On September 28, 2026 the Interlock ransomware group listed The Center for Kidney Care, a nephrology practice in Burlington County, New Jersey, on its leak site. As of October 9, 2026 the practice has not confirmed a breach, no patient count has been reported to regulators that we could find, and no lawsuit has been filed. There is no settlement and no claim form.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What Has Actually Been Reported
The Center for Kidney Care was founded in 1987 as Renal Hypertension Physicians and treats kidney disease and high blood pressure from offices in Hainesport and Burlington Township, including dialysis and post-transplant care.
Everything known so far comes from the attackers and from sites that monitor them. On September 28, 2026, Interlock claimed responsibility for an attack on the practice. In its own statement the group claims it took medical records, lab, dialysis and transplant data, billing and insurance data and patient demographics. Breachsense lists the leak at 40GB, discovered September 29, 2026.
These are claims, not findings. Ransomware groups post victims to pressure them into paying, and listings are sometimes exaggerated or recycled. The listing does not say how many people are affected.
Case Details
No court case exists. A search of federal dockets on CourtListener for “Center for Kidney Care” returned no data breach complaint as of October 9, 2026. So there is no court, no case number and no judge to report.
What does exist is a lawyer-recruitment page published September 29, 2026, saying attorneys are “looking into whether a class action lawsuit can be filed.” That is an investigation, not a lawsuit. In health data breaches a suit usually follows the practice’s own notice letters, not the leak-site post.
Status: Unconfirmed Breach, No Lawsuit, No Settlement
The next real milestone is a notice letter from the practice. Federal health privacy rules generally require one when patient data is confirmed exposed. If letters go out, a filing with HHS and a patient count should follow, and that is usually when lawsuits are filed.
Who Could Be Affected
If the claim holds up, the people at risk would be current and former patients of the practice, and possibly staff. The attackers’ list of data types (dialysis, transplant and lab records next to insurance details) points mainly at patients.
The test is a letter from the practice itself. Being a patient does not prove your records were taken. To ask whether you are included, call the practice’s main line at 856-222-1975, a number published on its own website. Do not use a number from an unsolicited email or text.
Is There Money? Not Now
For a sense of what an Interlock health breach can lead to, look at DaVita. Interlock hit DaVita on April 12, 2025, exposing data on 2,689,826 people. In Jenkins v. DaVita Inc. (District of Colorado), a $15 million settlement was proposed, reported September 1, 2026. It offers up to $2,500 for documented losses and a pro rata cash payment expected to be around $50. That is a different company and a far larger breach, so it is no forecast for this practice. You can also compare the University of Hawaii Cancer Center settlement.
Center for Kidney Care Breach Timeline
- 1
July 22, 2025 — Federal Warning About Interlock
FBI, CISA and HHS publish a joint advisory on Interlock, a double-extortion ransomware group first seen in late September 2024 that has hit healthcare targets.
- 2
September 28, 2026 — Interlock Lists the Practice
The group claims an attack on The Center for Kidney Care and says it took medical, dialysis, transplant, billing and insurance data. The practice does not confirm it.
- 3
September 29, 2026 — Monitors and Lawyers React
Breachsense logs a 40GB leak, and a lawyer-recruitment page opens an investigation. No complaint is filed.
- 4
October 9, 2026 — Still Unconfirmed
We found no notice from the practice, no regulator filing with a patient count and no lawsuit in the federal docket search.
- 5
Next — Watch for a Notice Letter
A confirmed breach would bring patient letters and an HHS filing. Lawsuits, if any, usually follow those.
Three Things to Watch For
A leak-site claim about kidney patients’ records, with no official notice yet, leaves room for imposters:
“Your dialysis records were leaked — pay to remove them”
Interlock is known for double extortion. A message to you as a patient demanding money to delete your records should go straight to the FBI at ic3.gov. Paying does not get the data back.
Callers claiming to be from the practice or your insurer
Stolen billing and demographic data make it easy to sound real. Hang up and call the number on the practice’s own website. Never give out your Social Security or Medicare number to an incoming caller.
“Claim your Center for Kidney Care settlement”
No settlement and no lawsuit exist as of October 9, 2026. Any site asking for your details to “register” for a payout is collecting data, not filing a claim.
Center for Kidney Care Breach — Questions People Actually Ask
Was The Center for Kidney Care actually hacked?
It is not confirmed. On September 28, 2026 the Interlock ransomware group claimed an attack, but as of October 9, 2026 the practice has not publicly confirmed a breach or put up a notice.
Is there a Center for Kidney Care data breach lawsuit?
No. As of October 9, 2026 no complaint appears in the federal docket search. Attorneys have only announced an investigation into whether a class action can be filed.
How many patients were affected?
Unknown. The leak-site listing does not give a number, and we found no filing with HHS or a state attorney general. Breachsense lists the claimed leak at 40GB, which says nothing reliable about headcount.
What data does the hacker group claim it took?
Per Interlock’s own statement: medical records, lab, dialysis and transplant data, billing and insurance data and patient demographics. These are the attackers’ claims, not verified findings.
Who is The Center for Kidney Care?
A South Jersey nephrology practice founded in 1987 as Renal Hypertension Physicians. It has eight nephrologists and three advanced practice nurses in offices in Hainesport and Burlington Township.
Is this the same as the DaVita breach?
No. DaVita is a separate national dialysis company. The same group, Interlock, attacked DaVita in April 2025. That case has a proposed $15 million settlement. It does not cover this practice’s patients.
Do I need to sign up somewhere to be included?
No. There is no case to join. If a class action is filed and settles, a court-appointed administrator contacts class members directly. Talking to a law firm is your choice, but a retainer is a contract, not a registration.
What is worth doing right now?
Freeze your credit at all three bureaus, which is free. Read your insurer’s and Medicare’s explanation-of-benefits statements for care you never received. Keep any letter the practice sends.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
Data Breach Settlement Calculator
Estimate what a breach settlement could pay if one is ever reached
Open Class Action Settlements
Settlements you can file a claim in right now, with deadlines
Settlement Payout Calculator
How pro rata class action payouts are actually divided
University of Hawaii Breach Settlement
A healthcare breach case that reached a settlement