DENVER, Sept. 8 — DaVita Inc., one of the largest U.S. dialysis providers, has agreed to pay up to $15 million to resolve a proposed class action lawsuit tied to a ransomware attack that struck the company in April 2025. A federal judge in Colorado granted preliminary approval to the deal in 2026, setting up a claims process that could pay cash, cover documented losses, and provide years of credit monitoring to affected patients. The case, Jenkins et al. v.
DaVita, Inc., No. 1:25-cv-01358-RMR-SBP, is pending in the U.S. District Court for the District of Colorado. The settlement caps DaVita’s exposure at $15 million, with a $10 million non-reversionary fund for class member relief — money that does not revert to DaVita if unclaimed.
The remainder covers attorneys’ fees, settlement administration costs, and service awards for five named class representatives.
No admission of liability
DaVita has made no admission of liability or wrongdoing; the agreement frames the payout as “a settlement not to exceed $15,000,000,” leaving room for the final number to land lower once claims are tallied. The incident is described as a ransomware attack that struck in April 2025, with some coverage tying it to the Interlock ransomware group, which targets healthcare and critical-services organizations using double-extortion tactics. Whether DaVita paid attackers is not part of the public settlement record.
The lawsuit argued DaVita failed to adequately protect patient data, a claim the company disputes. Dialysis records typically include names, Social Security numbers, treatment schedules, insurance and billing details, medical history, and clinical notes — the kind of sensitive information that, for patients across the region, can take years to untangle if misused.
What happens next
Legal-news outlet ClassAction.org reported the deal received preliminary approval in late August 2026, with a final approval hearing to be scheduled, likely in 2027. Reporting from HIPAA Journal and MedTech Dive detailed the settlement structure. The forensic investigation determined which data types and individuals were affected, a process that in large healthcare breaches takes months and often results in patient counts climbing as records are reviewed.
The settlement does not resolve every open question about the breach. This is one of the more closely watched healthcare-sector breach settlements moving through courts in 2026, following a string of healthcare breaches since 2023.
For patients and families covered by the class, the coming months will determine how much of that $10 million fund actually reaches those whose records were caught up in the attack.
