Loading Curie Briefs...
Getting the latest healthcare news for you
Getting the latest healthcare news for you
DaVita, one of the largest dialysis providers in the U.S., has agreed to pay $15 million to settle a class action lawsuit following a ransomware attack that exposed the personal and health data of 2.7 million patients. The attack, carried out by cybercriminal group Interlock, cost DaVita $25 million in 2025 and triggered at least ten lawsuits. When DaVita refused to pay the ransom, Interlock published victims' data on the dark web.
DaVita, which operates more than 2,600 dialysis centers across the U.S., has agreed to a $15 million settlement to resolve a class action lawsuit stemming from a ransomware attack carried out last April by a cybercriminal group known as Interlock. The breach exposed sensitive data for approximately 2.7 million patients — including names, addresses, Social Security numbers, health insurance details, dialysis lab results, and even images of checks. When DaVita declined to pay the ransom, Interlock published the stolen data on the dark web.
The attack forced DaVita to revert to manual processes and backup systems, ultimately costing the company $25 million in 2025 and spawning at least ten separate lawsuits that were later consolidated into a single complaint. A Colorado judge has signed off on the preliminary settlement, though a final approval hearing is yet to be scheduled.
By the Numbers:
Why it matters: This case underscores the escalating threat ransomware groups pose to healthcare organizations, where patient data is especially sensitive. Interlock's "double extortion" tactics — stealing data and encrypting systems — are becoming a go-to playbook, and DaVita's costly experience serves as a stark reminder that cybersecurity investment in healthcare is no longer optional.
