DaVita Inc. has agreed to a proposed settlement capped at $15 million over a 2025 ransomware attack, giving people in the United States whose records may have been accessed a path to compensation.
Under the agreement, $10 million would cover cash awards, one-bureau credit monitoring, administration, and attorneys’ fees and expenses approved by the court. A separate provision allows up to $5 million for qualifying loss reimbursements and any supplemental attorneys’ fees the court approves. The cap includes costs other than payments to class members.
Eligible claimants can request an estimated $50 cash payment, three years of one-bureau monitoring with identity restoration, and reimbursement of up to $2,500 per person for documented losses tied to the attack. They may select more than one benefit. The cash payment will depend on the number of valid claims and deductions from the $10 million fund. Loss reimbursements may be reduced if valid claims and related fees exceed the separate $5 million limit.
The proposed class covers people in the United States whose personal information may have been accessed in the incident. In the agreement filed Dec. 31, 2025, the parties estimated the class at about 2.4 million people. That estimate is not a final count of eligible claimants.
DaVita, a dialysis provider, disclosed in an April 2025 securities filing that the attack encrypted parts of its network and disrupted some operations while patient care continued. A later quarterly filing said data had been taken from its laboratory business, including personal and protected health information. DaVita also reported effects on billing, revenue collection and patient numbers.
The court-authorized notice says the information at issue differed by person and may have included Social Security numbers, insurance details, health conditions and dialysis test results. DaVita denies wrongdoing. The notice says the judge has not ruled on whether the company was at fault or violated the law.
The U.S. District Court for the District of Colorado granted preliminary approval on Aug. 21, 2026. Requests to opt out must be postmarked by Dec. 21, 2026, and objections must be filed by that date. Claims must be submitted online or postmarked by Jan. 19, 2027. The court is scheduled to consider final approval at a hearing in Denver on Feb. 18, 2027, at noon ET (10 a.m. MST).
