DaVita to pay $15 million to settle ransomware breach claims

DaVita will pay $15 million to resolve a proposed class action tied to a 2025 ransomware and data theft incident, and a Colorado federal court approved the preliminary settlement last week.

The incident reportedly affected nearly 2.7 million people. Exposed details potentially included patient names and addresses, Social Security numbers and health insurance information, plus dialysis lab results and pictures of checks sent to the provider.

The settlement establishes a compensation framework for nearly 2.7 million people whose medical and financial data may have been exposed in a health care ransomware incident. It offers cash payments and credit monitoring to class members. DaVita will pay breach claims after the preliminary settlement wins approval.

DaVita’s breach notice said the compromised dialysis labs database contained patient name, address, date of birth and Social Security number. The notice also listed health insurance details, internal identifiers, treatment information, health condition details and dialysis lab test results. For some people, the exposed data included tax identification numbers and possibly check images payable to DaVita.

Interlock, described as a financially motivated cybercriminal group, carried out the ransomware attack on DaVita. Ransomware is malware that locks systems and demands payment. Its usual method is to steal sensitive data, lock systems and threaten to leak the data unless a ransom is paid. One early legal complaint alleged that Interlock posted victims’ personal information on the dark web after DaVita declined to pay.

The complaint tied the leak to an unpaid ransom demand.

Dark web refers to hidden parts of the internet not indexed by standard search engines. Reports differ on when the attack occurred, with Yahoo Finance dating it to April 2025 and BnkInfoSecurity placing it in March 2025. Interlock said it leaked patient accounting records, eligibility documents, lab results and studies from a 1.5 terabyte cache on its darkweb site. The cache claim comes from the gang itself.

After finding the attack, DaVita switched to manual processes and backup systems to respond. DaVita’s IT operations were disrupted for a time.

Ten or more lawsuits were filed and later combined into one complaint. The lawsuit claimed DaVita was negligent because it did not put reasonable security procedures in place for the compromised information. The claims arose from the 2025 incident.

Class members may claim up to $2,500 for documented losses they paid out of pocket. To receive the money, they must submit proof of those losses. Every class member may get an estimated $50 pro rata payment from money left after documented loss claims are settled. Pro rata means a proportional share.

Three years of credit monitoring from one bureau can be requested by class members, with darkweb monitoring and identity theft insurance included. Single-bureau monitoring tracks one credit bureau’s file. No final approval hearing has been set, but one will take place next year.

The settlement agreement says the attack caused plaintiffs many injuries, including the continuing danger of fraud and identity theft. A DaVita spokesperson said the company understands the need to protect personal information and moved quickly after the attack. “We responded promptly to this attack and remain focused on strengthening our cybersecurity defenses,” the spokesperson said.

DaVita runs more than 2,600 outpatient dialysis centers across the United States. Another report puts its footprint at more than 3,000 kidney dialysis centers across the United States and in 14 other countries. The deal marks DaVita’s second multimillion class action data privacy settlement within two years.

In 2024, DaVita paid $3.8 million to settle Florida claims over tracking tools that allegedly shared patient data with Meta and Google. The earlier case also concerned patient privacy. Web tracking tools collect information about site visitors.

DaVita booked $25 million in charges tied to the 2025 ransomware attack. The company’s 2025 revenue exceeded $13.6 billion.