MCNA Dental has agreed to settle a class-action lawsuit stemming from a 2023 LockBit ransomware attack that affected nearly 9 million people.
The LockBit group gained access to MCNA’s network Feb. 22, 2023, and maintained access through March 7, 2023. The attackers exfiltrated roughly 700 gigabytes of data — including names, Social Security numbers, health insurance information and dental treatment records — and later published it after MCNA failed to pay a $10 million ransom.
Under the settlement, filed June 12 in the U.S. District Court for the Southern District of Florida, MCNA and co-defendant Healthplex — which MCNA acquired in 2019 — will pay up to $2,500 per class member for claims of undocumented out-of-pocket expenses. The claims are capped at $250,000 in total.
MCNA will also pay up to $2 million in administrative costs, up to $6.4 million in attorney fees and up to $1.3 million in additional litigation costs.
The company also agreed to continue to implement changes to further secure its systems, according to court documents.
The settlement is pending court approval.
