DaVita Settles Data Breach Lawsuit for $15 Million
DaVita has agreed to a proposed $15 million settlement to resolve litigation arising from a 2025 ransomware attack that compromised electronic protected health information (ePHI) of 2,689,826 individuals.
The ransomware incident occurred on April 12, 2025, when the Interlock ransomware group accessed DaVita’s network, exfiltrated data, and encrypted files. The incident caused a temporary disruption to operations. HIPAA-covered entity DaVita operates more than 3,000 kidney dialysis centers in the U.S. and 14 other countries.
A forensic investigation determined that ePHI belonging to 2,689,826 individuals was compromised. The information included names, contact information, medical insurance information, clinical data, Social Security numbers, and tax information.
Interlock claimed to have stolen over 20 terabytes of data. The group subsequently leaked around 1.5 terabytes of the data on its web data leak site after the ransom was not paid.
Consolidated Data Breach Litigation
Multiple class action lawsuits had been filed against DaVita after the data breach. The lawsuits alleged that the incident resulted from DaVita’s failure to implement reasonable and appropriate cybersecurity measures. The cases were consolidated as Julian Jenkins, et al v. DaVita Inc. in the United States District Court for the District of Colorado because they involved overlapping claims.
The litigation asserted claims involving negligence, unjust enrichment, breach of implied contract, breach of fiduciary duty, violation of privacy and state consumer protection statutes.
The lawsuit alleged that affected individuals faced a current, imminent, and ongoing risk of fraud and identity theft because of the theft of their personal data and protected health information (PHI) and the publication of that information on the dark web.
DaVita denied the claims and contentions in the lawsuit, including allegations of negligence, fault, and liability.
Proposed $15 Million Settlement
The parties negotiated a settlement intended to resolve the litigation without an admission of liability or wrongdoing by DaVita. The proposed settlement is valued at $15,000,000. The settlement amount covers attorneys’ fees and expenses, settlement management costs, a $10,000,000 non-revisionary settlement fund for relief to class members, and service awards for the five class representatives.
Class members may submit a claim for up to $2,500 to seek reimbursement for documented, unreimbursed out-of-pocket losses associated with the data breach. All class members, including those who submit claims for reimbursement of losses, may also claim a pro rata cash payment.
Class Member Payments
The amount of the pro rata cash payment that class members will receive will vary according to the number of valid claims received. The class consists of approximately 2.3 million individuals. If every class member submits a claim, the settlement would provide around $4.17 per class member. Based on the expected response rate, cash payments are estimated to be around $50 per class member.