Datavant $900,000 Data Breach Class Action Settlement

Individuals who received notice that a data breach at Ciox Health may have affected their personal information could qualify to submit a claim for up to $5,000 from a class action settlement. The cybersecurity incident impacted approximately 58,309 people.

Ciox Health LLC, d/b/a Datavant Group, agreed to pay $900,000 to settle a class action lawsuit related to an alleged phishing email attack that occurred May 8-9, 2024. The plaintiff claimed the incident allowed unauthorized access to a company email account, potentially exposing sensitive personal information, such as names, dates of birth, addresses, contact information, Social Security numbers, financial account details, driver’s license and passport numbers, and health-related data.

Who can file a claim for a data breach payout?

Class members are individuals whose personal information the Datavant data breach may have been compromised between May 8-9, 2024.

How much are settlement payments?

Class members have the following benefit options:

• Cash payment A - documented loss payment: Class members can claim up to $5,000 in documented out-of-pocket losses and expenses traceable to the data breach. Eligible expenses include internet usage charges, credit report costs, credit monitoring or fraud resolution services purchased between May 9, 2024, and Aug. 18, 2026, and other expenses or monetary losses due to identity theft or fraud.
• Cash payment B - alternative cash payment: Class members who do not submit a documented loss claim can submit a claim to receive a pro rata cash payment from the remaining net settlement fund. The settlement administrator will determine the final payment amount by the total number of claims filed.
• Expanded identity theft and fraud monitoring: All class members can elect to receive one year of single-bureau credit monitoring services, which includes up to $1,000,000 in insurance to cover any losses due to fraud or identity theft and access to a dedicated fraud specialist if needed.
• Class members who previously accepted credit monitoring from Ciox will receive an additional year of services if they submit a claim.

How to claim a class action rebate

To claim a settlement payment, class members can file a claim online or print a PDF claim form%20-%20Claim%20Form%20v1.pdf) to complete and mail to the settlement administrator.

Settlement administrator's mailing address: Datavant Data Security Incident Litigation, c/o Kroll Settlement Administration LLC, P.O. Box 5324, New York, NY 10150-5324

The claim deadline is Aug. 18, 2026.

Required proof and claim information

• All class members must provide the class member ID from the settlement notice they received.
• Documented loss claims require supporting documentation, which may include receipts, invoices, bank or credit card statements showing unreimbursed fees or fraudulent charges, and any other proof of expenses or monetary losses incurred as a result of the data breach.

Payout options

• Electronic payment (available only for online claims)
• Paper check mailed to the address provided

Settlement fund breakdown

The $900,000 settlement fund will include:

• Settlement administration costs: To be determined
• Attorneys' fees: Up to $315,000
• Attorneys' expenses: Up to $30,000
• Service award to class representative: Up to $2,500
• Expanded identity theft and fraud monitoring: Cost determined by number of claims filed
• Payments to approved claimants: Remaining settlement funds

Important dates

• Opt-out deadline: July 20, 2026
• Deadline to file a claim: Aug. 18, 2026
• Final fairness hearing: Sept. 4, 2026

When is the Datavant data breach settlement payout date?

The settlement administrator will issue payments to approved class members after it completes claim processing or approximately 120 days after the court grants final approval of the settlement, whichever is later.

Why is there a class action settlement?

The class action lawsuit alleged Ciox Health LLC, d/b/a Datavant Group, was responsible for a data breach caused by a phishing email attack. Unauthorized parties allegedly gained access to a company email account, potentially exposing sensitive personal data. The plaintiffs claimed the company was negligent and violated consumer protection laws.

Datavant denies the allegations but agreed to settle to avoid the expense and uncertainty involved with continued litigation.

Sources

1. Official class notice%20-%20Ex%20C%20-%20Long%20Form%20Notice%20rev%20v1.pdf)
2. Official settlement website FAQ page
3. Official claim form%20-%20Claim%20Form%20v1.pdf)