DaVita data breach settlement
Yes. The DaVita data breach settlement is real: a $10 million class action settlement in federal court, District of Colorado, run by Epiq. Claims are open until 19 January 2027, on dvacyberattacksettlement.com only.
The administrator says the deadline to submit a Claim Form is January 19, 2027; preliminary approval was granted on August 21, 2026.
Is it real?
Yes. The case is Jenkins v. DaVita Inc., case number 1:25-cv-01358, in the US District Court for the District of Colorado. The court appointed Epiq to run it, and its only official site is dvacyberattacksettlement.com.
How the real notice reached people. Direct notice by Email Notice to class members DaVita had a valid email for, otherwise by Postcard Notice through US Mail (postcards re-sent if emails bounce); Notice Date was October 20, 2026. The postcard carries a Unique ID and PIN and a tear-off claim sheet for the cash payment and credit monitoring. The site and FAQ publish no scam warning; the FAQ says not to telephone the Court or DaVita.
To tell a real message from a scam:
- The only official site is dvacyberattacksettlement.com.Type it into your browser yourself rather than tapping a link. Claim pages on news and lawyer-advertising sites, and lookalike addresses, are not the administrator.
- Filing costs nothing.No real settlement charges a fee to file a claim or to release a payment. Anyone asking for one is running a scam.
- Nobody needs your passwords.The administrator never asks for your DaVita password, your online banking login or a code texted to you. Payment details go only into the claim form on dvacyberattacksettlement.com.
- Check by phone.If you aren’t sure a message is real, call the administrator on 1-877-239-8791, the number on dvacyberattacksettlement.com, not one in the message.
Who qualifies
All U.S. persons whose Personal Information was potentially accessed without authorization in the April 2025 Ransomware Attack on DaVita, Inc. Excludes DaVita and its affiliates, officers and directors, the judges on the case and their families and staff, and anyone who opts out.
Size: approximately 2,394,674 persons (settlement class size in the settlement agreement).
It covers people in the United States only. If you live elsewhere, you are not part of it, whatever a message says.
How much
The total settlement is $10,000,000 non-reversionary Settlement Fund, plus documented-loss reimbursements paid separately (Supplemental Payment Amount capped at $5,000,000); the site calls it a settlement not to exceed $15,000,000. What each person can claim:
| Benefit | Amount | Notes |
|---|---|---|
| Pro Rata Cash Payment | currently estimated to be $50 | net Settlement Fund split among valid claims; goes up or down with the number of claims |
| Credit Monitoring | 3 years | one-bureau credit monitoring, dark web monitoring, identity theft insurance up to $1,000,000 and fully managed identity recovery; can be claimed with the other benefits |
| Documented Out-of-Pocket Losses | up to $2,500 per person | actual, documented, unreimbursed losses fairly traceable to the attack, incurred between April 11, 2025 and January 19, 2027; receipts not self-prepared; may be cut pro rata if loss claims plus the supplemental fee award exceed $5,000,000 |
An amount marked estimated or pro rata changes with the number of valid claims: more claims, smaller shares. Losses need proof, such as receipts or bank statements.
Deadline and payout
- Claim deadline: . Set by the court's 11 September 2026 order modifying settlement deadlines (90 days after the 20 October 2026 Notice Date); online or mailed claims postmarked by this date.
- Opt-out and objection deadline: .
- Final approval hearing: .
Payout. Benefits will be provided after the court approves the settlement and it becomes final; the administrator has not published a payment date.
The administrator: “The deadline to submit a Claim Form in this settlement is January 19, 2027.”
How to file
- Go to dvacyberattacksettlement.com and choose Submit a Claim (claim.dvacyberattacksettlement.com).
- Log in with the Unique ID and PIN printed on your email or postcard notice.
- Pick any or all of the $50 estimated cash payment, 3 years of credit monitoring, and documented losses up to $2,500 (losses need a full Claim Form with documents).
- Or mail the postcard's tear-off claim sheet, or a printed Claim Form, postmarked by January 19, 2027; you will get an email to choose electronic payment or check.
Official site: dvacyberattacksettlement.com. Phone: 1-877-239-8791. Mail: DaVita Ransomware Settlement, Settlement Administrator, P.O. Box 2943, Portland, OR 97208-2943.
The breach, and what to do today
Criminals hit DaVita, the kidney dialysis company, with a ransomware attack in April 2025, and patients' personal and health information may have been accessed. The complaint alleges the data was published on the dark web. DaVita began notifying affected people in early August 2025.
What was exposed: names; addresses; dates of birth; Social Security numbers; health insurance-related information; other identifiers internal to DaVita; health conditions and other treatment information; certain dialysis lab test results; tax identification numbers (some people); images of checks written to DaVita (limited cases).
A settlement pays for what already happened. The data is still out there, so do these now:
- Freeze your credit.In the US it’s free at Equifax, Experian and TransUnion, and no one can open credit in your name while it’s on. Lift it for a day when you apply for credit yourself.
- Get an IRS Identity Protection PIN.It stops anyone filing a tax return in your name with your Social Security number. Request one at irs.gov/ippin.
- Read your health insurance statements.Check each Explanation of Benefits for care you never had, and tell your insurer if you find any. Medical records can’t be changed like a password.
- Distrust messages about DaVita and this settlement.Breach data is used to make scam messages personal enough to believe, for years afterwards. Go to the company or the official site yourself.
To see which other breaches your email address is in, search it on Have I Been Pwned, then read Breaches.
Not published yet
The administrator and the court had not published these when HARD checked on 8 November 2026, so this page doesn’t guess:
- When payments will be sent.
Questions
Is the DaVita data breach settlement legit?
Yes. It is Jenkins v. DaVita Inc., case 1:25-cv-01358, in the US District Court for the District of Colorado. Epiq runs it for the court, and the only official site is dvacyberattacksettlement.com.
Who qualifies for the DaVita settlement?
All U.S. persons whose Personal Information was potentially accessed without authorization in the April 2025 Ransomware Attack on DaVita, Inc. Excludes DaVita and its affiliates, officers and directors, the judges on the case and their families and staff, and anyone who opts out.
How much will I get from the DaVita settlement?
Up to up to $2,500 per person for losses you can prove, or currently estimated to be $50 as a cash payment without receipts. The total settlement is $10,000,000 non-reversionary Settlement Fund, plus documented-loss reimbursements paid separately (Supplemental Payment Amount capped at $5,000,000); the site calls it a settlement not to exceed $15,000,000. Final amounts depend on how many valid claims there are.
What is the deadline for the DaVita settlement?
File by 19 January 2027, on dvacyberattacksettlement.com or by mail.
When will the DaVita settlement pay out?
Benefits will be provided after the court approves the settlement and it becomes final; the administrator has not published a payment date.
Other settlements: California Casualty, Finastra, Telmate, Covenant Health, AMCA, Warner Music Group, and the rest in Settlements.
Sources
Checked on 8 November 2026. HARD is not part of the case and doesn’t take claims.
- DaVita Ransomware Settlement: home and important dates, Epiq (Settlement Administrator), read 7 Nov 2026: claim, opt-out, objection and hearing dates; benefits; contact details.
- DaVita Ransomware Settlement: FAQ, Epiq (Settlement Administrator), read 7 Nov 2026: case name and number, class definition, benefit rules, $10,000,000 fund, hearing details.
- Postcard Notice, Epiq (court-approved notice), read 7 Nov 2026: Unique ID and PIN, tear-off claim sheet.
- Settlement Agreement (ECF 38-1, filed 12/31/25), US District Court for the District of Colorado (via settlement site), read 7 Nov 2026: class of approximately 2,394,674 persons; $10,000,000 fund; email then postcard notice plan.
- Order Modifying Settlement Deadlines and Setting Final Approval Hearing (ECF 47, 9/11/26), US District Court for the District of Colorado (via settlement site), read 7 Nov 2026: preliminary approval 8/21/26; notice date 10/20/26; deadlines and 2/18/27 hearing.