DaVita settles ransomware attack lawsuit for $15M
Nationwide kidney dialysis chain DaVita has agreed to pay $15 million to settle a class action lawsuit stemming from a 2025 ransomware attack that exposed sensitive patient data to hackers, the bulk of which was later leaked onto the dark web.
The hack impacted 2.7 million patients.
A judge in Colorado approved the settlement terms last week. Once finalized, a claimant website will be set up for victims to receive part of the payment. Commenting on the agreement, DaVita said the breach was an opportunity for it to upgrade its systems and harden its cyber-shell.
“We understand the importance of safeguarding personal information,” a spokesperson said. “We responded promptly to this attack and remain focused on strengthening our cybersecurity defenses.”
According to a statement the company released to investors this year, the attack cost it $25 million, unrelated to this settlement. There were multiple lawsuits filed against DaVita after the incident in April 2025, which were consolidated by the courts.
That consolidated complaint is what was settled last week.
The company operates more than 2,600 clinics nationwide. In a statement to HealthExec at the time of the cyberattack, DaVita denied there was any disruption to patient care, as its clinics were able to work off paper backups.
Interlock leaks data
In April, shortly after the ransomware attack, the cybercrime group Interlock claimed credit and showed on the dark web that it had the goods, posting a data trove of over 683,000 files, totaling 1.5TB, that it said it took from DaVita.
Interlock, known for its attacks across healthcare and the public sector, demanded a ransom—though it is not clear if one was ever paid.
The data from DaVita was listed as for sale for any cybercriminal willing to pay. A price was not listed in Interlock’s posting.
It is not known who, if anyone, bought the data. Compromised information on patients included names, contacts, and details on medical procedures.
A final date to approve the settlement has not yet been scheduled.
Chad is an award-winning writer and editor with over 15 years of experience working in media. He has a decade-long professional background in healthcare, working as a writer and in public relations.