DaVita will pay up to $15 million to settle a class action brought by patients whose records were exposed in an April 2025 ransomware attack. The case is Jenkins et al. v. DaVita, Inc., No. 1:25-cv-01358-RMR-SBP, in the U.S. District Court for the District of Colorado.
The figure is a ceiling. The agreement calls the payout “a settlement not to exceed $15,000,000,” so the final total could come in lower once claims are counted. DaVita admits no liability or wrongdoing. The lawsuit said the dialysis provider did not do enough to protect patient data, and the company disputes that.
The company told federal health regulators on August 1, 2025 that 2,689,826 current and former patients were affected, roughly 2.7 million people. Court filings and later coverage describe the intrusion as ransomware, and some reports tie it to the Interlock group, which is known for going after healthcare targets. Whether DaVita paid the attackers is not part of the public settlement record.
What patients can claim
Under the deal, as reported by HIPAA Journal and MedTech Dive, $10 million goes into a non-reversionary relief fund. Money left unclaimed does not go back to DaVita.
A patient with documented, unreimbursed losses from the breach, such as bank fees or identity-theft costs, can claim up to $2,500. A patient with no paperwork can instead take a flat pro rata cash payment. Either way, class members get three years of credit monitoring that includes dark web monitoring and identity theft insurance.
What each person receives depends on how many of the 2.7 million file claims.
Court approval
Bloomberg Law reported that Judge Rodriguez granted preliminary approval on August 21, 2026. That step clears the way for notice to go to class members and for the claims window to run. It is not final. A fairness hearing is set for February 18, 2027, where the judge will hear objections and decide whether to sign off, including on the fee awards.
Dialysis patients need treatment several times a week, and the records behind that care run deep: Social Security numbers, treatment schedules, insurance and billing details, medical history and clinical notes. Misuse of that kind of file can take years to untangle for families who rely on the clinic.
