DaVita’s $15 Million Ransomware Settlement Is Being Written Up as “About $50 a Person.” Judge Rodriguez’s Own Order Does the Other Arithmetic in a Single Sentence: $4.17, If Everyone Files. The Class Went From 1.2 Million People in the Complaint to 2.3 Million in the Deal — and the Claim Deadline Nobody Has Published Is Sitting in the Order as a Countdown.

Read the two figures together and the settlement stops being confusing. The estimated $50 is what a claimant plausibly receives at a normal claims rate — which in consumer data-breach settlements is usually low single-digit percent. The $4.17 is the floor the court computed for the hypothetical in which every one of the 2.3 million class members files. Neither number is a promise. The order is explicit that the cash payment is “reduced or increased pro rata based on the claims raised and availability of funds.”

In plain terms: the more people who file, the less each person gets. That is the arithmetic of a fixed non-reversionary fund, and it is worth understanding before you read any headline that puts “$50” next to your name. It also cuts the other way, and this is the part that gets left out — non-reversionary means nothing goes back to DaVita. Money not claimed by one class member is available to the others. Filing is not a lottery ticket you are diluting for strangers; it is your share of a pot that will be distributed either way.

The court defended the size of the deal by comparison, citing two data-breach settlements by name: Kostka v. Dickey’s Barbecue Restaurants, where a class of more than three million people settled for $2.3 million, and In re Herff Jones Data Breach Litigation, where more than one million people settled for $4.35 million — “approximately $4.35 per person,” as the order puts it. Against those, $10 million for 2.3 million people is roughly comparable, which is precisely the point the court was making.

One benefit is not diluted by anyone: the credit monitoring. Reporting on the settlement terms describes three years of single-bureau monitoring with dark-web scanning and identity-theft insurance. The order itself refers only to “the same credit-monitoring services” without stating a term, so we attribute the three-year figure to the settlement terms as reported rather than to the order.

This is why every article says the claim deadline is unknown. The order does not print dates. It prints intervals, each measured from “entry of this Preliminary Approval Order” — which was August 21, 2026. Two of the rows depend on when class counsel hands the class list to Epiq and cannot be pinned down yet. The rest can.

Read these as outer limits, not appointments. The order says each event happens “within” its interval, so the administrator can set an earlier date, and the notice you receive in the mail governs. The fairness hearing is not on the calendar at all yet: the order directed the parties to “contact the Court’s chambers to set a date for the fairness hearing within 7 days of the entry of this Order,” and it can be any date on or after the 180-day mark.

What the countdown is good for is planning. If you were among the roughly 2.3 million people whose information was in this attack, you have until somewhere around mid-November 2026 to decide whether to opt out and keep your right to sue individually, and until somewhere around mid-December 2026 to file a claim. Not “sometime in 2027,” which is what “final approval hearing in February 2027 or later” makes it sound like.

Coverage of this settlement quotes at least four class sizes. They are not all errors; they are measurements of different things at different times, and the order shows two of them sitting a few pages apart.

• ~1.2 million — what the operative complaint alleged, cited in the order to the amended complaint.
• 2.3 million — the settlement class, cited in the order to the motion for preliminary approval. The court uses this figure twice.
• 2,689,826 — the figure reported by HIPAA Journal, the kind of precise count that typically traces to a breach notification.
• ~2.4 million / ~2.7 million — rounded versions circulating in trade coverage.

The number that governs your rights is the settlement class definition, not any headline: the order approves a class of individuals in the United States whose personal information was potentially accessed without authorization in the ransomware attack. If DaVita sent you a notification letter about the April 2025 incident, you are almost certainly in it regardless of which total a given article printed. When the notice goes out, it will say so directly.

The doubling between complaint and settlement is not suspicious, and it is a pattern worth recognizing: initial complaints are filed on early public reporting, and the real scope arrives later from the forensic review. The reported data categories here are broad — names, contact information, Social Security numbers, health insurance information, clinical information and tax records — with over 20 terabytes reportedly exfiltrated and roughly 1.5 terabytes posted.

• There is no settlement website yet. The order requires one and names Epiq as administrator, but the notices go up only after class counsel delivers the class list. Anything presenting itself as a DaVita $15 million claim page today is not the administrator.
• Do not confuse this with the older DaVita case. A separate $3.8 million DaVita settlement over website tracking pixels ran at dvapixelsettlement.com with Kroll as administrator and a claim deadline of December 4, 2024. That one is closed. It is a different case, a different theory and a different class — and it is the first thing that comes up in some searches.
• Start the documented-loss file now. The $2,500 tier is the only part of this settlement that is not diluted by how many people file, and it is the part that requires paperwork: bank and card statements, fraud reports, credit-freeze fees, time-off records. Assembling that in December from memory is how people end up taking the $50 tier by default.
• Mark mid-November, not December, if you are thinking about opting out. The exclusion deadline lands roughly a month before the claims deadline. Miss it and the release binds you whether or not you ever file.