Anyone in the United States whose personal information may have been taken in the April 2025 ransomware attack on dialysis provider DaVita has until Jan. 19, 2027 to file a claim in a data breach settlement. The settlement sets aside $10 million, with an estimated $50 cash payment for each valid claim and up to $2,500 for documented losses. Nothing is paid until a federal judge in Colorado gives final approval, and that hearing is set for Feb. 18, 2027.
Who is covered by the DaVita settlement
The settlement class covers all U.S. persons whose personal information was potentially accessed in the attack, according to the court-approved notice. That information includes names, addresses, dates of birth, Social Security numbers and health insurance details. It also includes some clinical information, such as health conditions and certain dialysis lab test results, and in limited cases images of checks written to DaVita.
Patients and former patients who got a notice in the mail should look for the unique ID and PIN printed on it, because online claimants need both, ClaimDepot reports. People who think their data was exposed but never got a notice can contact the administrator at 1-877-239-8791 or through the settlement website before the January deadline.
The claim can be filed two ways. ClaimDepot says the online form takes the ID and PIN from the notice, and a PDF form can be printed and mailed instead. The mailed form has to be postmarked by Jan. 19, 2027, the same day the online window closes.
Stay ahead of settlement and refund news: Miss an enrollment or claim deadline and the money can be gone. Join the Retirement Money Brief and we’ll send you our Open Settlements & Refund Tracker as a welcome gift.
Get the Brief + the settlements tracker →
We may earn a commission from links on this page.
What the settlement pays
The fund is $10 million, and the notice says supplemental payments are capped at $5 million and paid separately. Each class member who files a valid claim can take a pro rata cash payment, estimated at $50. That amount can rise or fall depending on how many valid claims come in.
Class members who lost money can also seek reimbursement of documented out-of-pocket losses, up to $2,500 per person. The notice lists identity theft, fraud, falsified tax returns, real estate title fraud, financial fraud and government benefits fraud among the covered categories.
The notice also offers three years of credit monitoring from one bureau, dark web monitoring, identity theft insurance of up to $1 million and fully managed identity recovery services. Class members elect that on the claim form.
A documented-loss claim takes more than a form, and the notice spells out what it wants. The notice asks for receipts or other documentation of the unreimbursed loss, a description of each loss and an explanation of how it is fairly traceable to the ransomware attack. It also requires a signed attestation under penalty of perjury.
Self-prepared documents, such as handwritten receipts, are by themselves insufficient, the notice says, so a printed statement or an agency letter carries more weight. A family that found a fraudulent tax return or a hijacked benefits account should gather the bank letter, the IRS notice or the lender statement before sitting down to file.
Deadlines, the hearing and when checks go out
Requests to opt out must be postmarked by Dec. 21, 2026, and objections must be filed with the court by the same day. Claim forms must be submitted online or postmarked by Jan. 19, 2027. The final approval hearing is Feb. 18, 2027 at 10 a.m. before U.S. District Judge Regina Rodriguez in Denver, in the case Jenkins v. DaVita Inc., No. 1:25-cv-01358. The notice says the date and format may change, so the settlement website is the place to confirm it.
Payments go out after the court resolves any appeals and grants final approval, ClaimDepot says. Class members can choose Zelle, PayPal, Venmo or an ACH transfer, and anyone who picks no electronic option gets a mailed check.
What DaVita and the plaintiffs say happened
The attack came from a ransomware group called Interlock, and DaVita first discovered it around April 12, 2025. Healthcare Dive reported on Sept. 2 that about 2.7 million people were affected and that at least ten lawsuits were consolidated into one complaint. The outlet put the settlement at $15 million once the supplemental payments are counted.
The first complaint alleges that Interlock published victims’ personal data on the dark web after DaVita did not pay a ransom. The settlement agreement says the plaintiffs suffered injuries including the ongoing threat of fraud and identity theft. DaVita told Healthcare Dive that it responded promptly to the attack and remains focused on strengthening its cybersecurity defenses. The attack cost the company $25 million in 2025, according to the same report.
Because Social Security numbers and dialysis lab results were among the data types named in the notice, the three years of monitoring and the $1 million identity theft insurance may matter more to some families than the $50 estimate. The notice describes the monitoring as a benefit class members can elect, so it is worth reading the claim form’s options line by line before submitting.
Did a DaVita settlement notice arrive in the mail?
A notice about a data breach settlement is easy to set aside, and the Jan. 19 claim deadline is the only way into the $50 estimated payment, the credit monitoring or a loss reimbursement. A fraud loss also needs paper proof, which is hard to collect after the date passes.
The Settlement & Refund Recovery System shows how to read a notice and gives a step-by-step filing walkthrough, so the opt-out date, the claim date and the hearing date all land on one calendar. It also includes a claim log and payment tracker for recording what was filed and what arrived.
Log the DaVita claim with the settlement notice walkthrough and payment tracker →
This article was produced with AI assistance and edited for accuracy against the sources linked above.
