DaVita Ransomware Data Breach Settlement

DaVita breach victims may claim. This settlement resolves consolidated class actions over the April 2025 ransomware attack on DaVita Inc., the kidney dialysis company, which the settlement agreement attributes to the ransomware group Interlock. The Settlement Agreement puts the class at approximately 2,394,674 people whose Personal Information was potentially accessed without authorization. Four things are worth getting straight before you file. First, this is a stacking settlement, not an either/or one. The official notice says you may submit a claim for any or all of three benefits: a pro rata cash payment estimated at $50, up to $2,500 in documented out-of-pocket losses, and three years of credit monitoring with up to $1,000,000 in identity theft insurance. A class member with receipts can take all three on one Claim Form. Second, the $2,500 cap comes out of a different, smaller pool than the $50 cash. The $50 is a share of the $10,000,000 Settlement Fund; the $2,500 reimbursement draws from a separate pool capped at $5,000,000 total — and that same pool also pays any Supplemental Attorneys' Fees Award the Court approves, up to $1.5 million, so a large fee award can shrink what is left for claimants. DaVita's total exposure is capped at $15,000,000 across both pools. Third, unlike some similar breach settlements, the official Long Form Notice does not require a Unique ID or PIN to file — Claim Forms are available online, by phone, or by mail directly from the administrator, Epiq. Fourth, nothing is paid until the settlement is final. The Final Approval Hearing is set for February 18, 2027, and benefits go out only after approval and the end of any appeals. Claims are due January 19, 2027. Opting out or objecting is due earlier, by December 21, 2026.

Do I Qualify?

You may be eligible if:

• You are a U.S. person whose Personal Information was potentially accessed without authorization in the April 2025 ransomware attack on DaVita Inc. The Settlement Agreement puts the class at approximately 2,394,674 people
• The class is NATIONWIDE with no state restriction — the case is in federal court in Colorado (Jenkins v. DaVita Inc., No. 1:25-cv-01358, D. Colo.), but residence in Colorado is not required and benefits do not vary by state
• The information involved varied by person and may have included names, addresses, dates of birth, Social Security numbers, health insurance information, DaVita's own internal identifiers, and clinical information such as health conditions, treatment information and dialysis lab results; for some people it included tax identification numbers and, in limited cases, images of checks written to DaVita
• You are excluded if you are DaVita itself, an entity DaVita controls, or one of DaVita's affiliates, parents, subsidiaries, officers, directors, legal representatives, successors or assigns. Also excluded: any judge presiding over the case along with their immediate family and judicial staff, and anyone who timely and validly opts out by December 21, 2026
• YOU DO NOT NEED A UNIQUE ID OR PIN TO FILE. Unlike some other data breach settlements, the official Long Form Notice imposes no ID or PIN requirement — Claim Forms are available at DVACyberattackSettlement.com, by calling 1-877-239-8791, or by writing to the Settlement Administrator at P.O. Box 2943, Portland, OR 97208-2943
• You may claim any or all of three benefits on one Claim Form: the pro rata cash payment, the documented loss reimbursement, and the credit monitoring. Taking one benefit does not use up or reduce another
• Documentation is required ONLY if you claim the up-to-$2,500 reimbursement for out-of-pocket losses. The cash payment and the credit monitoring need no receipts at all
• You submit a timely and valid Claim Form by January 19, 2027 — online at the official site, or mailed and postmarked by that date

There is really only one proof question here, and it depends entirely on which benefit you claim. The $50 pro rata cash payment and the three years of credit monitoring need no supporting documents at all — you submit a valid Claim Form and attest under penalty of perjury that you are a Settlement Class Member. Only the up-to-$2,500 reimbursement for Documented Out-of-Pocket Losses requires records. The Settlement Agreement requires that each loss be actual, documented, and unreimbursed, fairly traceable to the Ransomware Attack, and that it occurred between April 11, 2025 and January 19, 2027. You must also show you made reasonable efforts to avoid or recover the loss — including disputing unauthorized charges and exhausting any existing credit monitoring or identity theft insurance — and attest under penalty of perjury that the loss is genuine. Self-prepared documents such as handwritten receipts are, by themselves, insufficient. The notice calls for third-party records: receipts or other documentation you did not create yourself. The Settlement Administrator has sole discretion to decide whether a claimed loss is valid and fairly traceable, weighing the timing of the loss, whether it involved the type of information exposed in the breach, and your written explanation. One more thing the notice does not require: a Unique ID or PIN. Some similar data breach settlements gate their claim forms behind a code printed on the mailed notice; this one does not. Claim Forms for DaVita are available directly from the administrator, Epiq — online, by phone at 1-877-239-8791, or by mail — whether or not you still have your notice.

What Happened?

DaVita Inc. is a Denver-based kidney dialysis company that treats patients and maintains their Personal Information, including clinical and treatment records, as part of its business

DaVita discovered a criminal ransomware attack on its systems on or around April 12, 2025, and disclosed it in an SEC filing on April 14, 2025. The settlement agreement attributes the attack to the ransomware group Interlock

The Personal Information potentially accessed varied by person and could have included names, addresses, dates of birth, Social Security numbers, health insurance information, DaVita's own internal identifiers, and clinical information such as health conditions, treatment information and dialysis lab results; for some people it included tax identification numbers, and in limited cases, images of checks written to DaVita

About a dozen class actions followed in Colorado and Missouri. The Colorado cases were consolidated as Jenkins v. DaVita Inc., Case No. 1:25-cv-01358, before the Honorable Regina M. Rodriguez in the U.S. District Court for the District of Colorado

The parties reached a settlement at an October 2025 mediation and filed the Settlement Agreement on December 31, 2025. The Court granted preliminary approval on August 21, 2026, then on September 11, 2026 reset the schedule and set the Final Approval Hearing for February 18, 2027, making October 20, 2026 the notice date

The Court appointed Bart D. Cohen of Bailey Glasser LLP, J. Gerard Stranch IV of Stranch, Jennings & Garvey PLLC, and Gary M. Klinger of Milberg PLLC as Class Counsel

DaVita denies the claims and denies any wrongdoing or liability, and the Court has not decided who is right; the parties settled to avoid the risk, cost and time of continuing the litigation

This is a capped settlement, not an open-ended one: DaVita's total payment obligation is capped at $15,000,000 — a $10,000,000 Settlement Fund covering the cash payments, administration costs, attorneys' fees and service awards, plus a separate $5,000,000 pool capped for documented out-of-pocket loss reimbursements and a possible supplemental fee award

Epiq is the court-appointed Settlement Administrator. Benefits are distributed only after final approval and the resolution of any appeals, with payments to follow within 45 days after that point; no payment date has been set

How to File Your Claim

1. FILE AT DVACYBERATTACKSETTLEMENT.COM — the official settlement website, run by the court-appointed administrator, Epiq. Submit your Claim Form online by January 19, 2027, or mail it to the Settlement Administrator, postmarked by that date, at: DaVita Ransomware Settlement, Settlement Administrator, P.O. Box 2943, Portland, OR 97208-2943. Claim Forms are also available by calling toll-free 1-877-239-8791
2. NO UNIQUE ID OR PIN IS REQUIRED TO FILE. The official notice imposes no such requirement — if you were not notified or lost your notice, call the administrator or check the website
3. CLAIM ANY OR ALL THREE BENEFITS ON ONE FORM: the $50 pro rata cash payment, up to $2,500 in documented out-of-pocket losses, and three years of credit monitoring. None of the three requires giving up another
4. MIND THE EARLIER DECEMBER 21, 2026 DATE. Requests for exclusion (opt-outs) must be mailed and postmarked by December 21, 2026 to the same P.O. Box address, must be submitted individually (no mass or class exclusion requests), and cannot be made online, by phone, or by email. Objections must be filed with the Court by that same date
5. NOTHING IS PAID YET. The Final Approval Hearing is set for February 18, 2027 at 10:00 a.m. before Judge Regina M. Rodriguez at the Alfred A. Arraj Courthouse in Denver. The notice warns the date and time are subject to change and the hearing may be held by video or phone, so check the settlement website. Benefits are provided only after the settlement is approved and becomes final, including the end of any appeals
6. no payment date has been announced
7. QUESTIONS: call 1-877-239-8791 or visit DVACyberattackSettlement.com
8. Visit the official claim form: https://dvacyberattacksettlement.com/

How Much Will I Actually Get?

THIS SETTLEMENT LETS YOU CLAIM ANY OR ALL OF THREE BENEFITS — IT IS NOT AN EITHER/OR CHOICE. The Long Form Notice says in plain terms that you may submit a claim for any or all of the listed benefits. A class member with documented losses can receive the cash payment, the loss reimbursement, AND the credit monitoring on the same Claim Form. (1) PRO RATA CASH PAYMENT, estimated at $50. This comes out of the $10,000,000 Settlement Fund after Notice and Claims Administration Costs, the Attorneys' Fees Award, Service Awards, and the cost of claimed Credit Monitoring are paid, divided by the number of valid cash claims — it rises if fewer people claim and falls if more do. (2) DOCUMENTED OUT-OF-POCKET LOSSES, up to $2,500 per person, for losses fairly traceable to the Ransomware Attack that occurred between April 11, 2025 and January 19, 2027. CRITICAL: THIS $2,500 CAP IS FUNDED FROM A SEPARATE, SMALLER POOL THAN THE CASH PAYMENT — NOT FROM THE $10 MILLION FUND. That reimbursement pool is capped at $5,000,000 total, and the same pool also pays any Supplemental Attorneys' Fees Award the Court approves for Class Counsel's work securing the loss-reimbursement benefit, up to $1,500,000. If the combined total of valid loss claims and that supplemental fee award exceeds $5,000,000, reimbursements are reduced on a pro rata basis. DaVita's total payment obligation across both pools is capped at $15,000,000. (3) CREDIT MONITORING: three years of one-bureau Credit Monitoring, dark web monitoring, identity theft insurance coverage up to $1,000,000, and identity recovery services, which may be claimed in addition to the other two benefits at no extra cost. NEITHER CASH FIGURE IS FIXED: both the $50 estimate and the final loss-reimbursement total are pro rata figures that move up or down depending on how many people file valid claims. Class Counsel will ask the Court to approve Attorneys' Fees, Costs and Expenses of up to one-third of the $10,000,000 fund, plus the Supplemental Attorneys' Fees Award described above, and Service Awards of up to $2,500 for each Class Representative. The Court decides those amounts at the Final Approval Hearing and may award less.

Last reviewed: October 20, 2026 | Information verified from court records and official settlement documents.

Frequently Asked Questions