DaVita sued after data breach allegedly exposed 20TB of dialysis patient info

DaVita data breach class action lawsuits overview:

• Who: Three patients filed class action lawsuits against DaVita Inc.
• Why: The plaintiffs allege DaVita’s negligence led to a data breach that compromised their personal and health information and that of others.
• Where: The DaVita class action lawsuits were filed in Colorado federal court.

DaVita Inc. is facing two proposed class action lawsuits alleging the company’s negligence led to a data breach that compromised the private information of its patients.

Plaintiffs Ivan Thomas Reid Jr., Julian Jenkins and Lydia Perryman’s class action lawsuits allege the data breach has already resulted in identity theft and fraud.

The plaintiffs say DaVita has yet to offer any details about the data breach, which the company announced on April 14.

DaVita, which provides kidney care services, reported on April 14 in an 8-K filing with the U.S. Securities and Exchange Commission (SEC) that it became aware of a “ransomware incident” concerning encrypted elements of its network around April 12.

DaVita did not provide details in the SEC filing about the type of information accessed but said it was “actively working to assess and remediate the incident” with help from third-party cybersecurity professionals, according to media reports.

“Given the recency of the incident, our investigation and response are ongoing, and the full scope, nature and potential ultimate impact on the Company are not yet known,” DaVita said in the filing, as reported by Law360.

DaVita patient data for sale on the dark web, lawsuits claim

The lawsuits claim the ransomware group Interlock carried out the attack and that more than 20 terabytes of sensitive DaVita patient data is reportedly up for sale on the dark web, with 1.5 terabytes of stolen data already leaked.

Reid argues DaVita has not made any effort to help with reviewing credit monitoring and identity theft protection services, nor has it offered to monitor financial accounts for unusual activity.

He claims he is at “present risk and will continue to be at increased risk of identity theft and fraud for years to come” as a result of the data breach.

Meanwhile, Jenkins and Perryman argue DaVita has not disclosed any details of the data breach, which they claim has resulted in Jenkins receiving suspicious text messages about a medical appointment that did not exist.

“Without such disclosure, questions remain as to the full extent of the Data Breach, the actual data accessed and compromised and what measures, if any, DaVita has taken to secure the [personally identifiable information] and [personal health information] still in its possession,” Jenkins and Perryman say.

In 2024, DaVita agreed to a $3.8 million settlement to resolve claims that it improperly disclosed patients’ personally identifiable and protected health information through third-party web tracking tools.

Have you been affected by the DaVita data breach? Let us know in the comments.

Reid is represented by T.J. Jesky of the Law Offices of T.J. Jesky, while Jenkins and Perryman are represented by Victor S. Woods and Bart D. Cohen of Bailey Glasser LLP.

The DaVita data breach class action lawsuits are Reid v. DaVita Inc., Case No. 1:25-cv-01362, and Jenkins, et al. v. DaVita Inc., Case No. 1:25-cv-01358-SBP, both in the U.S. District Court for the District of Colorado.

Read About More Class Action Lawsuits & Class Action Settlements:

• Segway class actions claim recalled scooters pose fall hazard, no refunds offered
• Tomatoes recalled in 14 states over Salmonella contamination
• Rover class action alleges pet care service fails to disclose fees upfront
• Roblox class action claims company secretly tracks children’s data