MedTech Dive reports that DaVita, one of the largest dialysis providers in the U.S., has agreed to pay $15 million to settle a proposed class action lawsuit arising from a data breach that affected approximately 2.7 million people last year.
Once the preliminary settlement is approved, DaVita will pay out claims associated with the breach, according to an agreement signed off by a Colorado judge last week.
The ransomware group known as InterLock compromised DaVita on March 24, 2025 and remained in their network until April 12, 2025, when DaVita was able to evict the attacker and keep them out. Attempting to pressure DaVita, the attackers claimed they would leak 1.5 TB of data if they were not paid. Ultimately, the attackers did leak some data and tried to sell the remainder.
According to DaVita’s disclosure at the time, the types of information included patients’ names and “provider name, address, date of birth, social security number, health insurance-related information, and other identifiers internal to DaVita, as well as certain clinical information, such as health condition, other treatment information, and certain dialysis lab test results. For some individuals, the information included tax identification numbers, and in limited cases images of checks written to DaVita.”
Read more at MedTech Dive.
