This is not a new DaVita hack. Claims opened on 20 October 2026 for DaVita’s April 2025 ransomware attack, and if you are a US person whose personal information was potentially accessed without authorisation in the attack, you may be able to claim cash, credit monitoring, or reimbursement for documented losses. The deadline to file is 19 January 2027, and the settlement is not yet final: a final approval hearing is set for 18 February 2027.
Note the order of the deadlines: the opt-out and objection deadline of 21 December 2026 comes before the claim deadline of 19 January 2027, so anyone considering opting out must act first.
What can you claim?
Settlement class members may claim any or all of three benefits. The first is a pro rata cash payment currently estimated at $50. The second is three years of one-bureau credit monitoring and identity theft restoration services. The third is reimbursement of up to $2,500 for documented, unreimbursed, qualifying out-of-pocket losses fairly traceable to the incident, subject to the settlement’s documentation and mitigation requirements.
Two conditions matter. You must file a claim form to receive any benefit, online at DVACyberAttackSettlement.com or by mail using a form from the same site; you can also call 1-877-239-8791 to have a form mailed to you, but the number is not a way to file a completed claim by telephone. And the cash and loss payments may rise or fall pro rata depending on the total value of timely and valid claims, so the headline figures are estimates, not fixed payouts.
What the $50 figure really means
Our calculation, labelled as TechReview’s own analysis and presented as a hypothetical only: the $15 million cap divided by the settlement agreement’s class of roughly 2,394,674 people works out at $6.26 per person if the whole cap were spread evenly. The cap is not one pool: it comprises a $10 million settlement fund plus a separate supplemental fund of up to $5 million. The $10 million settlement fund divided by $50 gives 200,000 claimants, which is 8.35% of the class, and that is before the notice, administration, fee, and monitoring deductions that come out of the fund first. If every class member claimed $50, the cash bill would be $119,733,700, nearly twelve times the $10 million fund.
The $50 figure is therefore a take-up assumption, not a promise. It only works if a small fraction of the class files a cash claim. Attorneys’ fees from the main fund may be up to one-third of that fund, and the supplemental fund separately permits supplemental attorneys’ fees of up to $1,500,000. Reasonable litigation costs and $2,500 service awards for each class representative will also be considered at the final approval hearing.
Who is covered, and what data was involved?
The settlement class covers all US persons whose personal information was potentially accessed without authorisation in the attack. The information involved varied by individual and may have included names, addresses, dates of birth, Social Security numbers, health insurance information, and other identifiers internal to DaVita, as well as clinical information such as health conditions, other treatment information, and certain dialysis lab test results. For some people it included tax identification numbers, and in limited cases images of checks written to DaVita.
The attack began on 24 March 2025 and continued until the intruders were blocked from DaVita’s servers on 12 April 2025. DaVita disclosed the attack in an April 2025 SEC filing, saying it had encrypted certain elements of its network while patient care continued. DaVita reported the breach to the US Department of Health and Human Services, with 2,689,826 individuals affected, making it one of the largest healthcare breaches reported that year. DaVita said it would notify the impacted individuals via mail and offer credit monitoring and identity theft protection to those affected. DaVita runs more than 2,600 outpatient centres in the US, plus 367 centres in 11 other countries. Public reporting has attributed a responsibility claim to the Interlock ransomware group; the official settlement notice confirms the ransomware attack but does not itself establish the perpetrator.
The class-size gap you should know about
There is a gap between the two headcounts in the record, and it is worth stating plainly. The Department of Health and Human Services figure is 2,689,826 people affected. The settlement agreement figure is roughly 2,394,674 people, a difference of 295,152, or about 11% below the regulator figure. The two figures also come from different records, a regulator filing and a settlement agreement, and should not be treated as directly comparable counts of an identical population measured the same way. The cited material reviewed does not establish why the figures differ; a refined count is only an unverified inference, not a sourced fact.
The gap does not change who can file. The claims notice defines the class by whether your information was potentially accessed, not by either headcount, so eligibility turns on that definition rather than on which total you read.
How to file, and the dates that matter
Work through these in order.
- File your claim online at DVACyberAttackSettlement.com or by mail. If you need a paper form, call 1-877-239-8791 and ask for one to be mailed to you.
- File by 19 January 2027, online or postmarked by that date, to receive any benefit.
- Opt out by postmarked 21 December 2026 if you do not want to be legally bound by the settlement.
- Object by 21 December 2026 if you oppose the settlement, the fees, or the service awards.
- Doing nothing results in no settlement benefits and leaves you bound by the settlement and court judgments if the settlement is approved.
The final approval hearing takes place on 18 February 2027. You are not required to attend it whether or not you object. The claims notice also says settlement class members should not contact the court or DaVita about the settlement; questions go to the settlement site or the 1-877-239-8791 line.
What to watch next
The next fixed point is the final approval hearing on 18 February 2027, when the court will consider approval, the fee requests, and any timely objections. The settlement remains subject to final court approval. Payments also depend on the settlement becoming final and on the claims and distribution process. The claims notice gives no specific payment date, and the hearing date is not a promised payment date. Settlement coverage reports that class members are being notified by postcard or email. If you filed, keep your claim confirmation and any receipts for documented losses, since the loss part of the settlement turns on documentation.
Frequently asked questions
Is the settlement final? No. It has received preliminary approval, and final approval will be considered at the hearing on 18 February 2027. Until then, the settlement has not become final.
Do I need to prove I was affected? You must file a claim form for any benefit. The up-to-$2,500 part covers documented out-of-pocket losses, so keep receipts and records for costs fairly traceable to the attack, such as identity theft, fraud, or falsified tax returns, but not every expense in those categories necessarily qualifies. Reported coverage puts the documented-loss window at 11 April 2025 to 19 January 2027.
What happens if I do nothing? You get no settlement benefits and you are still bound by the settlement and any judgments and orders the court issues if the settlement is approved.
Should I opt out? Opting out by 21 December 2026 preserves your right to sue separately, but it gives up any settlement benefits. Doing nothing gives no benefits either, while still leaving you bound to the settlement if it is approved.
Is the $50 cash payment guaranteed? No. It is currently estimated at $50 and may rise or fall pro rata depending on the total value of timely and valid claims.
Sources
- Epiq via PR Newswire: Settlement reached in putative class action against DaVita Inc.
- TechTarget: DaVita ransomware attack impacts 2.7M individuals
- CyberInsider: DaVita confirms ransomware attack impacted 2.7 million individuals
- OpenClassActions: DaVita ransomware data breach settlement
- TEISS: DaVita faces $15 million payout over major patient data breach
