DaVita $15 Million Data Breach Settlement, Claim an Estimated $50, Up to $2,500 for Documented Losses and 3 Years of Credit Monitoring by January 19, 2027

DaVita, Inc. has agreed to a settlement worth up to $15 million to resolve a class action over a 2025 ransomware attack that potentially exposed patients’ personal, financial and health information. If your information was potentially accessed, you can claim an estimated $50 payment with no proof of loss, up to $2,500 for documented out-of-pocket losses, and three years of credit monitoring. You can claim any or all three on one form.

The claim deadline is January 19, 2027. The deadline to opt out or object is December 21, 2026. DaVita denies wrongdoing, and the court has not decided who is right. The settlement still needs final approval.

Official settlement website: https://dvacyberattacksettlement.com/ File a claim online: https://claim.dvacyberattacksettlement.com/login (you need the Unique ID and PIN from your notice)

Quick Facts: DaVita Ransomware Settlement

Detail	Information
Official settlement website	https://dvacyberattacksettlement.com/
Online claim form	https://claim.dvacyberattacksettlement.com/login
Case	Jenkins v. DaVita Inc., No. 1:25-cv-01358
Court and judge	U.S. District Court, District of Colorado; Judge Regina M. Rodriguez
Total settlement value	Not to exceed $15,000,000
Settlement Fund	$10,000,000
Separate supplemental amount	Up to $5,000,000, for documented losses and any supplemental fee award
Who is covered	All U.S. persons whose personal information was potentially accessed without authorization in the ransomware attack
Pro rata cash payment	Estimated $50, no proof required
Documented losses	Up to $2,500 per person
Credit monitoring	Three years, one-bureau, with identity theft insurance up to $1 million
Claim deadline	January 19, 2027 (online, or mail postmarked by that date)
Opt-out and objection deadline	December 21, 2026
Final approval hearing	February 18, 2027, 10:00 a.m. Mountain, Courtroom A901, Denver
Settlement administrator	Epiq
Class counsel	Bart D. Cohen (Bailey Glasser); J. Gerard Stranch IV (Stranch, Jennings & Garvey); Gary M. Klinger (Milberg)

What Happened in the DaVita Ransomware Attack?

DaVita, a Denver-based kidney dialysis provider, disclosed in an April 14, 2025 SEC Form 8-K that it became aware on April 12 that ransomware had encrypted parts of its network. It said it activated incident response, isolated affected systems, brought in outside cybersecurity experts and notified law enforcement, and that it kept providing patient care through contingency plans. Press reports based on DaVita’s breach notice say the intruders had access from March 24, 2025 until they were blocked on April 12. The Interlock ransomware group claimed responsibility and posted data it said it took.

According to the settlement website, the information involved varied by person and may have included:

• Names, addresses and dates of birth
• Social Security numbers and, for some people, tax identification numbers
• Health insurance information and internal DaVita identifiers
• Clinical information such as health conditions, treatment information and dialysis lab results
• In limited cases, images of checks written to DaVita

That does not mean every person had every category exposed or that anyone’s identity was misused. DaVita reported the breach to federal regulators as affecting about 2.7 million people (2,689,826 in the HHS report). One outlet reported shortly after that the number might be revised to about 2.4 million, and a litigation tracker uses 2.4 million. The settlement defines the class by who was potentially affected, not by a fixed number.

Who Qualifies?

The class is all U.S. persons whose personal information was potentially accessed without authorization in the ransomware attack. If you received a breach notice or a settlement postcard, you are very likely in the class. You do not have to be an identity theft victim to claim the $50 payment or credit monitoring.

Excluded are DaVita and its affiliates and officers, the judges on the case and their immediate families and staff, and anyone who validly opts out.

No postcard? That does not automatically exclude you. Call Epiq at 1-877-239-8791 or email [email protected] to ask for help verifying your membership and getting the information needed to file.

What the Settlement Provides

1. Pro rata cash payment (estimated $50). Every class member can claim this without documentation. The amount is what remains in the $10 million Settlement Fund after administration costs, attorneys’ fees and costs, service awards and the cost of claimed credit monitoring, divided by the number of valid claims. More claims means a smaller payment, and fewer claims means a larger one.

2. Documented out-of-pocket losses (up to $2,500). This reimburses actual, unreimbursed costs fairly traceable to the attack, such as identity theft, fraud, falsified tax returns, real estate title fraud, government benefits fraud or other misuse of your information. To qualify:

• The loss occurred between April 11, 2025 and January 19, 2027.
• You made reasonable efforts to avoid or recover it, including disputing unauthorized charges and using up any existing credit monitoring or identity theft insurance.
• You provide third-party documentation, such as receipts. Handwritten or self-prepared records alone are not enough, though they can explain other evidence.
• You briefly describe each loss, explain how it is traceable to the attack, and attest under penalty of perjury that your claim is accurate and unreimbursed.

The administrator decides whether a loss is valid and traceable. An expense that happened after the attack is not automatically caused by it.

3. Credit monitoring (three years). This includes one-bureau credit monitoring, dark web monitoring, identity theft insurance up to $1 million and fully managed identity recovery. You can claim it along with either or both cash benefits. It does not guarantee you will not be a victim, and the insurance policy’s terms and exclusions apply.

Can you claim the $50 and the $2,500? The settlement says you may claim any or all benefits, so an eligible person may claim both, subject to the requirements and possible reductions.

How the $15 Million Is Structured

The headline number is a ceiling, not one pot divided equally.

Component	Amount	Pays for
Settlement Fund	$10,000,000	Administration and notice, attorneys’ fees and costs, service awards, credit monitoring and the pro rata cash payments
Supplemental amount	Capped at $5,000,000	Valid documented-loss claims and any supplemental attorneys’ fee award
Total	Not to exceed $15,000,000

Class counsel will ask for fees of up to one-third (about 33.33%) of the $10 million fund plus reasonable litigation costs, and may ask for a supplemental fee of up to $1.5 million from the separate amount. Service awards of up to $2,500 each may be requested for the class representatives. The court may award less. If valid documented-loss claims plus any approved supplemental fee exceed $5 million, loss reimbursements are reduced proportionally. The total actually paid out could be less than $15 million.

How to File a Claim

1. Open the online claim portal and log in with the 10-character Unique ID and four-digit PIN from your postcard notice. Or download the paper form from the Documents page, or call 1-877-239-8791 for one.
2. Choose the benefits you want. If you claim documented losses, include your documents and attestation.
3. Submit by January 19, 2027, or mail the paper form postmarked by that date to: DaVita Ransomware Settlement, Settlement Administrator, P.O. Box 2943, Portland, OR 97208-2943.
4. Save your confirmation. Tell the administrator if your mailing or email address changes after you file.

Filing is free. Never pay a third party to submit your claim. Benefits are provided after the court approves the settlement and it becomes final.

Your Options and Deadlines

Option	What happens	Deadline
Submit a claim	The only way to get settlement benefits	January 19, 2027
Opt out	No benefits. You keep the right to sue DaVita over the released claims	Postmarked by December 21, 2026
Object	You stay in the class and tell the court why you disagree	Filed by December 21, 2026
Do nothing	No benefits, and you give up your rights over the released claims if the settlement becomes final	None

To opt out, you must mail an individual written request with your original signature, the case name, your full name, address and phone number, and a clear statement that you want to be excluded. You cannot opt out online, by phone or by email, and mass exclusion requests are invalid. Send it to the P.O. Box above.

To object, file a written objection with the Clerk, U.S. District Court, Alfred A. Arraj Courthouse, 901 19th Street, Denver, CO 80294-3589. It must include the case name and number, your contact details, why you are a class member, whether you object in whole or in part, the legal and factual basis, supporting documents, any lawyers involved, whether you plan to appear, and your original signature. You cannot both opt out and object.

Important Dates

Date	Event
March 24 to April 12, 2025	Reported period of unauthorized access
April 12 to 14, 2025	DaVita discovers the attack and files its SEC disclosure
April 30, 2025	First class action filed
June 16, 2025	Court consolidates related actions and appoints interim co-lead counsel
July 30, 2025	Consolidated amended complaint filed
October 6, 2025	Mediation produces a settlement in principle
December 31, 2025	Settlement agreement filed
August 21, 2026	Preliminary approval (as reported)
December 21, 2026	Opt-out and objection deadline
January 19, 2027	Claim deadline
February 18, 2027, 10:00 a.m.	Final approval hearing

The hearing date can change and may be held by video or phone. Check the settlement website. The website asks people not to call the court or DaVita.

Why Was DaVita Sued?

The consolidated complaint alleged that DaVita failed to use reasonable measures to protect personal and health information, which allowed criminals to access it and caused financial and privacy harm. The claims included:

• Negligence. The plaintiff must show a duty, breach, causation and legally recognized damages. A successful attack alone does not prove negligence.
• Negligence per se. Based in part on the Federal Trade Commission Act and HIPAA security standards. It does not mean any violation was proven.
• Implied contract. Patients allegedly provided information expecting it to be protected.
• California claims. The Confidentiality of Medical Information Act (Cal. Civ. Code §§ 56.101 and 56.36), the California Consumer Privacy Act and the Unfair Competition Law. The CCPA’s private right of action for data breaches is limited and does not cover every alleged violation.
• Arizona Consumer Fraud Act, alleging concealment of facts about data security.
• North Carolina law, including the security breach notification statute (N.C. Gen. Stat. § 75-65) and unfair trade practices law (§ 75-1.1), alleging unreasonably delayed notice.

DaVita denies all of these allegations. The settlement is not a court finding that DaVita violated any law.

What Laws Apply to Healthcare Data Breaches?

• HIPAA. The Privacy, Security and Breach Notification Rules (45 C.F.R. Parts 160 and 164) require covered providers to safeguard health information, with administrative, physical and technical protections. Individuals must be notified without unreasonable delay and within 60 days of discovery, HHS must be notified, and breaches affecting more than 500 residents of a state require media notice. The HHS Office for Civil Rights enforces HIPAA. HIPAA does not give individuals a private right to sue for damages, so breach class actions rely on state-law and other theories.
• FTC Act. Section 5 (15 U.S.C. § 45) lets the FTC pursue unfair or deceptive data security practices. There is no private right of action for individuals.
• SEC rules. Public companies must disclose material cybersecurity incidents on Form 8-K, which is why DaVita’s attack was public within days.
• State breach notification laws. Every state has one, with different deadlines. Colorado, where DaVita is based, requires prompt notice to affected residents. Whether any notice was late is a separate question this article does not decide.
• Standing. In federal court, plaintiffs must show a concrete injury (TransUnion v. Ramirez, 2021). Courts often debate whether risk of identity theft is enough, which is one reason settlements include both no-proof payments and loss reimbursement.

A Separate $3.8 Million DaVita Settlement

Do not confuse this with an earlier case alleging that tracking tools on DaVita’s websites, patient portals and apps shared information with third parties. DaVita agreed to a $3.8 million settlement in that separate matter, which has its own website, class definition and deadlines. This ransomware settlement covers only the April 2025 incident as defined in its agreement.

Why Medical Data Breaches Carry Special Risk

A password can be changed, but a Social Security number, birth date and dialysis history cannot. Combined, they can support fraudulent accounts and loans, false insurance claims, tax fraud, medical identity theft and targeted phishing that uses details of your treatment. These are risks, not proof that every affected person experienced any of them.

How to Protect Yourself

1. Review your accounts and insurance statements for unfamiliar activity or services you did not receive.
2. Check your credit reports for free at AnnualCreditReport.com.
3. Consider a credit freeze at all three nationwide bureaus. Federal law makes freezes free to place and lift. A fraud alert is another option.
4. Use unique passwords and multifactor authentication.
5. Be wary of targeted scams that use medical details. Verify unexpected requests using contact details you find yourself.
6. Keep records of fraud, fees and time lost to support a documented-loss claim.
7. Report identity theft at IdentityTheft.gov if you suspect misuse.

Credit monitoring does not replace checking your accounts. Settlement payments may be taxable income, so ask a tax professional if you are unsure.

Related Coverage

For help preparing a claim, see How to Claim a Lawsuit Settlement Money? Step-by-Step Guide (2026). For other healthcare data breach settlements, see the Esse Health $2.525M data breach settlement and the FMC Services $2.15M data breach settlement. When comparing settlements, look at money available per person, the evidence required and whether monitoring is included, not just the headline total.

How to Contact the Settlement Administrator

• Website: https://dvacyberattacksettlement.com/
• Email: [email protected]
• Phone: 1-877-239-8791
• Mail: DaVita Ransomware Settlement, Settlement Administrator, P.O. Box 2943, Portland, OR 97208-2943

Frequently Asked Questions

Is the DaVita settlement really $15 million?

That is the maximum. A $10 million fund pays for cash payments, monitoring, fees and costs. A separate amount of up to $5 million covers documented-loss claims and a possible supplemental fee. The total paid depends on claims.

How much will I get?

An estimated $50 for the pro rata payment, which can rise or fall. You can also claim up to $2,500 for documented losses, and three years of monitoring.

Do I need proof?

Not for the $50 payment or monitoring. Documented-loss claims need third-party records and a sworn attestation.

Can I claim $2,500 without identity theft?

Only if you have actual, unreimbursed losses fairly traceable to the attack. Otherwise the $50 payment is likely the right option.

What is the deadline?

January 19, 2027 to claim. December 21, 2026 to opt out or object.

I got free monitoring from DaVita earlier. Can I still claim?

Yes, the settlement offers its own three-year benefit. For documented-loss claims, you must first use up existing monitoring or insurance, so check the FAQ.

When will payments arrive?

After the court approves the settlement and any appeals are resolved. The hearing is February 18, 2027.

Has DaVita admitted wrongdoing?

No. The agreement says DaVita denies the claims and any liability.

What if I do nothing?

You get no benefits and are bound by the release if the settlement becomes final.

What if I opt out?

You get no benefits but keep the right to bring your own claim, which may not succeed. Your request must be mailed and postmarked by December 21, 2026.

Is the website legitimate?

Use https://dvacyberattacksettlement.com/. It is the court-authorized site operated by Epiq. Never pay anyone to file a claim.

Sources

1. Official settlement website, FAQ, documents page and online claim portal, Jenkins v. DaVita Inc., No. 1:25-cv-01358 (D. Colo.): https://dvacyberattacksettlement.com/ (administered by Epiq).
2. Settlement Agreement (Exhibit 1), posted on the official website and Epiq’s document server.
3. DaVita Inc., Form 8-K filed April 14, 2025 (sec.gov).
4. ClassAction.org coverage of the litigation and the August 21, 2026 preliminary approval.
5. HIPAA Journal, “DaVita Confirms 2.7 Million Individuals Affected by Ransomware Attack”; TechTarget HealthTech Security, “DaVita ransomware attack impacts 2.7M individuals.”
6. Security Affairs (August 23, 2025) and The Register (August 22, 2025) on the number affected.
7. HIPAA Privacy, Security and Breach Notification Rules, 45 C.F.R. Parts 160 and 164, and HHS complaint guidance (hhs.gov/hipaa).
8. 15 U.S.C. § 45; Cal. Civ. Code §§ 56.101, 56.36; N.C. Gen. Stat. §§ 75-1.1 and 75-65; TransUnion LLC v. Ramirez, 594 U.S. 413 (2021).
9. AnnualCreditReport.com and IdentityTheft.gov.

Written by Israr Ahmad, legal content researcher at AllAboutLawyer.com. Last updated October 20, 2026. This article is general information, not legal or tax advice. AllAboutLawyer.com is not a law firm and is not affiliated with DaVita or the settlement administrator. Eligibility, payment amounts and deadlines are controlled by the official settlement documents, and the settlement remains subject to final court approval. Verify details on the official settlement website before filing.