DAVITA has agreed to pay $15 million to settle a class action lawsuit arising from a 2025 ransomware attack that exposed sensitive patient data and, in many cases, was later leaked on the dark web. The incident affected 2.7 million patients, according to the report, and prompted multiple lawsuits that were consolidated by the courts.
A Colorado judge approved the settlement terms the previous week, with DaVita indicating the breach offered an opportunity to upgrade its systems and strengthen cybersecurity. The company disclosed in a separate investor statement that the attack cost it about $25 million, a figure described as unrelated to the settlement.
The case chronology notes that the 2025 breach led to a number of legal actions, underscoring the ongoing regulatory and reputational risks for healthcare providers following ransomware intrusions.