DAVITA INC.

DaVita Inc. based in Denver, Colorado, a healthcare – medical provider entity reported a data breach to the Texas Attorney General. The breach was discovered on 2025-04-12 and reported on 2025-08-04. 81,740 Texas residents were affected. 915,952 individuals affected in total. Types of information involved: Name of individual;Address;Social Security Number Information;Driver’s License number;Government-issued ID number (e.g. passport, state ID card);Financial Information (e.g. account number, credit or debit card number);Medical Information;Health Insurance Information;Date of Birth. Consumers were notified via Notice by publication in print media;Posted at company website or special website;U.S. Mail.

DaVita Inc. notified Montana residents of a data breach affecting dialysis lab databases. Unauthorized access occurred March 24–April 12, 2025. Data exposed included PII (SSN, DOB, address), PHI (health conditions, lab results), and financial data. DaVita engaged forensic experts, notified law enforcement, and offered credit monitoring.

DaVita Inc. notified Nebraska AG of a breach affecting dialysis lab records. Unauthorized access occurred March 24–April 12, 2025. Data included PII (SSN, DOB), PHI (clinical/dialysis data), and financial info. DaVita engaged forensic experts, notified law enforcement, and offered credit monitoring. Incident contained April 12, 2025.

DaVita Inc. reported to HHS on 2025-08-01 a Hacking/IT Incident affecting 2,689,826 individuals. Breached information located on Network Server.

DaVita Inc. reported a cybersecurity incident affecting its dialysis lab servers. The incident occurred from March 24, 2025, to April 12, 2025, involving unauthorized access to patient data including names, SSNs, DOBs, health insurance info, and clinical/dialysis records. DaVita engaged forensic experts, notified law enforcement, and enhanced security monitoring. No evidence of fraud was found at the time of notification.

DaVita Inc. reported a data breach to the Oregon Attorney General. The breach was reported on 2025-08-01. The breach occurred during 3/24/2025 - 4/12/2025. The breach was discovered on 4/12/2025. 915,952 individuals were affected. Notice was sent on 8/1/2025.

DaVita Inc. reported a ransomware incident affecting Washington residents. Unauthorized access occurred from March 24 to April 12, 2025. The breach exposed PHI, SSNs, and financial data for 13,404 individuals. DaVita engaged forensic experts, notified law enforcement, and offered credit monitoring.

DaVita Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2025-08-01. 7,829 Massachusetts residents were affected.

DaVita Inc. filed an 8-K on April 14, 2025, reporting a ransomware incident discovered on April 12, 2025. The attack encrypted certain elements of the company's network and is impacting some of its operations; DaVita states it continues to provide patient care. DaVita isolated systems, engaged third-party cybersecurity professionals, and notified law enforcement. The full scope and duration of disruption remain unknown.

DaVita Inc. provides kidney dialysis services for patients suffering from chronic kidney failure in the United States. The company operates kidney dialysis centers and provides related lab services in outpatient dialysis centers. It also offers outpatient, hospital inpatient, and home-based hemodialysis services; operates clinical laboratories that provide routine laboratory tests for dialysis and other physician-prescribed laboratory tests for ESRD patients; and management and administrative services to outpatient dialysis centers. In addition, the company offers integrated care and disease management services to patients in risk-based and other integrated care arrangements; clinical research programs; physician services; and comprehensive kidney care services. Further, it engages in the provision of acute inpatient dialysis services and related laboratory services; and transplant software business.

DaVita Inc. reported a data breach to the Oregon Attorney General. The breach was reported on 2024-07-03. The breach occurred during 11/20/2017 - 12/14/2023. The breach was discovered on 6/17/2024. Notice was sent on 7/3/2024.

DaVita Inc. reported to HHS on 2024-07-03 a Unauthorized Access/Disclosure affecting 67,443 individuals. Breached information located on Network Server. The breach involved the disclosure of protected health information (PHI) through web tracking applications on health portal websites and mobile applications. The PHI included clinical and demographic information. DaVita implemented additional safeguards and retrained workforce members.

DaVita Inc. disclosed that online tracking technologies (pixels) on its health portal and mobile app may have transmitted personal information, including IP addresses, usernames, employment status, and patient classification, to third-party vendors. The incident was determined on June 17, 2024. The breach window listed on the CA AG form is December 14, 2023. DaVita removed/disabled non-compliant technologies and implemented new policies and training. No SSNs, financial data, or clinical records were involved.

DaVita Inc. (CO) reported to HHS on 2022-09-06 a Hacking/IT Incident (email phishing attack) affecting 1,092 individuals. An employee was the victim of a phishing attack compromising PHI including names, Social Security numbers, addresses, dates of birth, diagnoses, lab results, and other treatment information. Breached information located on Network Server. DaVita notified HHS, affected individuals, and the media; provided credit monitoring; implemented additional technical safeguards; and retrained workforce members.

DaVita HealthCare Partners Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2016-04-22. 1 Massachusetts residents were affected. The report records the breach type as electronic.

DaVita HealthCare Partners reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2013-11-12. 16 Massachusetts residents were affected. The report records the breach type as electronic.

DaVita reported the theft of an unencrypted laptop from an employee's vehicle on September 6, 2013. The device contained patient health information, including diagnoses, insurance details, and Social Security numbers. DaVita notified affected patients on November 5, 2013, and offered one year of complimentary credit monitoring. The company reviewed encryption practices and implemented additional safeguards.

DaVita reported to HHS on 2013-11-05 a Theft affecting 11500 individuals. Breached information located on Laptop. An employee's unencrypted laptop containing patient ePHI (diagnosis, insurance, SSN) was stolen from a locked car on September 6, 2013.

DaVita Healthcare Partners reported a data breach to the Delaware Attorney General. The breach occurred on 2013-09-01. Notice was filed on 2013-11-05. Information involved: health basic, identity government.

DaVita reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2009-10-26. 1 Massachusetts residents were affected. The report records the breach type as electronic.

DaVita, Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2008-11-17. 25 Massachusetts residents were affected. The report records the breach type as electronic.

DaVita Inc. (via subsidiary OVA Renal Healthcare, Inc.) notified New Hampshire authorities on March 3, 2008, of a data breach affecting 9 residents. A password-protected laptop containing patient PII (SSNs, medical insurance info) was stolen from an employee's vehicle around February 4, 2008. Law enforcement was notified, and individual letters were sent on February 21, 2008.