DaVita Inc., one of the largest kidney dialysis providers in the United States, has agreed to pay $15 million to resolve a consolidated class action lawsuit stemming from a 2025 ransomware attack that exposed the personal and health information of approximately 2.7 million people. A judge in the U.S. District Court for the District of Colorado signed off on the preliminary settlement last week, clearing the way for claims to be processed once final approval is granted.
DaVita operates more than 3,000 kidney dialysis centers across the United States and 14 other countries, including upward of 2,600 outpatient locations domestically. On April 12, 2025, a cybercriminal group known as Interlock breached the company’s network, extracted data and encrypted internal systems, disrupting normal operations and forcing DaVita to rely on manual processes and backup systems while it responded. The company has said the incident cost it $25 million in 2025.
A forensic investigation later determined that the electronic protected health information of 2,689,826 individuals had been compromised. The exposed data included names, addresses, Social Security numbers, health insurance details, dialysis lab results, clinical information, tax records and images of checks written to the company. Interlock claimed to have extracted more than 20 terabytes of data from DaVita’s systems and, after the company did not pay a ransom, posted roughly 1.5 terabytes of that material to its dark web leak site, one of the initial legal complaints alleged.
The Health Information Sharing and Analysis Center, a group that tracks cyber threats facing the health sector, has identified Interlock as a known perpetrator of attacks against health care organizations, including a prior ransomware attack on Ohio-based Kettering Health. The group is known for double extortion tactics, in which stolen data is used as leverage alongside encrypted systems to pressure victims into paying.
At least ten separate lawsuits followed the breach and were later consolidated into a single case, Julian Jenkins, et al v. DaVita Inc., in Colorado federal court. The consolidated complaint accused DaVita of negligence, breach of implied contract, unjust enrichment, breach of fiduciary duty, invasion of privacy and violations of state consumer protection laws. Plaintiffs argued the theft and subsequent dark web publication of their data left them facing an ongoing and immediate risk of fraud and identity theft, and the settlement agreement states the incident caused them “numerous injuries.” DaVita has denied the allegations and has not admitted fault or liability as part of the settlement.
Under the terms of the deal, $15 million will cover attorneys’ fees, litigation expenses, settlement administration costs and service awards for five class representatives, with $10 million set aside as a non-revisionary fund to compensate class members directly. Members of the roughly 2.3 million-person settlement class can file claims for up to $2,500 to cover documented, unreimbursed losses tied to the breach. All eligible class members, including those seeking reimbursement, are also entitled to a separate pro rata cash payment, with the exact amount depending on how many valid claims are ultimately submitted. If every class member filed a claim, payments would total roughly $4.17 each; based on anticipated response rates, administrators expect individual payments closer to $50.
A company spokesperson said DaVita takes data protection seriously. “We understand the importance of safeguarding personal information,” the spokesperson said. “We responded promptly to this attack and remain focused on strengthening our cybersecurity defenses.”
A hearing for final approval of the settlement has not yet been scheduled and is expected to take place next year.
