Dive Brief:
- DaVita, one of the largest dialysis providers in the U.S., has agreed to pay $15 million to settle a proposed class action lawsuit over a data breach that impacted approximately 2.7 million people last year.
- Once the preliminary settlement is approved, DaVita will pay out claims associated with the breach, according to an agreement signed off by a Colorado judge last week.
- “We understand the importance of safeguarding personal information,” a DaVita spokesperson said. “We responded promptly to this attack and remain focused on strengthening our cybersecurity defenses.”
Dive Insight:
DaVita, which provides kidney dialysis services at more than 2,600 outpatient centers in the U.S., was hit by a ransomware attack last April at the hands of Interlock, a financially motivated cybercriminal group.
The ransomware attack cost DaVita $25 million in 2025 and prompted at least ten lawsuits. The suits were later consolidated into a single complaint, which is now being settled.
Upon discovering the ransomware attack last spring, DaVita said it had to revert to manual processes and use its backup systems to respond to the attack.
The data breach potentially exposed patient names, addresses, Social Security numbers, health insurance information, dialysis lab test results and pictures of checks written to the provider.
The cybercriminals in question, known as Interlock, are known offenders in healthcare, according to the Health Information Sharing and Analysis Center, an organization that shares cyber threat intelligence. Interlock carried out a ransomware attack against Ohio-based system Kettering Health last year.
The group typically engages in double extortion, a strategy in which threat actors steal sensitive data and encrypt systems, then threaten to leak the stolen data if victims refuse to pay a ransom.
When DaVita failed to pay, Interlock published victims’ personal information on the dark web, one of the initial legal complaints alleged.
The ransomware attack caused the lawsuit plaintiffs to sustain “numerous injuries” including the ongoing threat of fraud and identity theft, the settlement agreement says.
A final approval hearing has not yet been scheduled, but will take place next year.
