MCNA Dental Settles Multi-Million-Dollar Class Action After LockBit Breach

Managed Care of North America (MCNA) Dental has agreed to a multi-million-dollar class action settlement to resolve claims stemming from a massive 2023 data breach. The agreement follows a ransomware attack that compromised the sensitive personal and health information of approximately 8.9 million people.

The breach was attributed to the LockBit ransomware group. While the total value of the settlement fund has not been publicly disclosed, the agreement provides for cash payments to eligible class members. Those who can provide documentation of out-of-pocket losses resulting from the breach may be eligible for higher reimbursement amounts. Eligibility is limited to individuals who received a formal breach notification from MCNA and had their protected health information or personal data exposed.

The Security Failure

MCNA Dental operates as one of the largest dental insurers in the United States, with a primary focus on serving beneficiaries of the Children's Health Insurance Program (CHIP) and Medicaid. The class action lawsuit alleged that the company failed to implement adequate security measures to protect its network and failed to detect the LockBit intrusion in a timely manner. Because the company serves a high volume of government-funded healthcare recipients, the breach put millions of patients—including a significant number of children—at an increased risk of identity theft and financial fraud.

Industry Implications

This settlement underscores the persistent vulnerability of healthcare data, particularly within specialized sectors like dental insurance and Medicaid-related services. The scale of the incident, affecting nearly 9 million individuals, establishes a significant precedent for corporate liability regarding ransomware attacks targeting health insurance providers. As healthcare entities increasingly digitize patient records, the MCNA case highlights the legal and financial consequences of failing to maintain robust detection and prevention systems against known ransomware threats.

Next Steps for Claimants

Affected individuals should monitor for official communication regarding the claims process. The settlement focuses on compensating those who were directly notified of the exposure of their protected health information. While the multi-million-dollar fund is established, the final distribution per person will depend on the total number of valid claims filed and the documentation provided for specific losses. Legal observers will be watching to see if this settlement prompts further security audits across other large-scale Medicaid dental providers.