DaVita Agrees to $15 Million Settlement Over 2025 Interlock Ransomware Attack
Kidney dialysis provider DaVita will pay $15 million to settle class action lawsuits stemming from a 2025 ransomware and data theft incident attributed to the Interlock gang, impacting nearly 2.7 million individuals.
Global kidney dialysis provider DaVita has agreed to a $15 million settlement to resolve class action lawsuits following a significant ransomware and data theft incident in 2025. The attack, attributed to the notorious Interlock ransomware gang, impacted approximately 2.7 million individuals and exposed sensitive patient information.
The preliminary settlement, approved by a Colorado federal court, allows affected individuals to claim up to $2,500 for documented out-of-pocket losses incurred due to the breach. Additionally, all class members are eligible for a pro-rata payment of an estimated $50, provided funds remain after documented loss claims are settled. To further support victims, DaVita will also offer three years of single-bureau credit monitoring, including darkweb monitoring and identity theft insurance.
The Interlock gang claimed responsibility for the attack, leaking approximately 1.5 terabytes of data from a cache they reportedly stole in March 2025. This stolen data included patient accounting records, government and payer eligibility documents, lab results, and various studies. DaVita's own breach notification confirmed that compromised data included names, addresses, dates of birth, social security numbers, health insurance information, and other DaVita-specific identifiers. In some cases, the compromised data also extended to tax identification numbers and images of checks written to the company.
Beyond the extensive data theft, the Interlock ransomware attack also caused disruptions to DaVita's IT operations, impacting its ability to provide services. The company reported that the cyber incident resulted in $25 million in charges during 2025. The class action litigation against DaVita alleged negligence in failing to implement and maintain adequate security measures to protect the sensitive information compromised in the attack.
This settlement marks the second major class action resolution for DaVita concerning data privacy issues in recent years. In 2024, the company agreed to a $3.8 million settlement to resolve litigation related to its use of third-party web tracking and analytics tools on its websites. That incident allegedly led to the disclosure of patient web usage data to third parties, including Meta and Google.
The Interlock attack on DaVita underscores the persistent and severe risks faced by the healthcare sector, particularly concerning ransomware and data exfiltration. The sheer volume of affected individuals and the sensitive nature of the compromised data highlight critical failures in data protection practices within large healthcare organizations. The financial and reputational costs associated with such breaches continue to mount, emphasizing the urgent need for robust cybersecurity investments and stringent data handling protocols.