Legal & Privacy Brief

Today: Transamerica Life Insurance agreed to a $110 million class action settlement over allegations it failed to properly credit cash value increases to policyholders. Community Dental Care reached a separate settlement over a data breach affecting customer information. The Missouri Supreme Court blocked implementation of a new congressional map that would have favored Republicans, ruling that a referendum petition was valid and the map cannot take effect until approved by voters.

Litigation Updates

$110M Transamerica Life Insurance class action settlement

Transamerica Life Insurance has agreed to a $110 million class action settlement resolving allegations that the company failed to credit certain cash value increases to eligible Direct Recognition Life policies. The settlement addresses claims that policyholders did not receive the full value increases they were entitled to under their policy terms.

• Compliance Action: Insurance companies and financial services firms should review their Direct Recognition Life policies and crediting practices to ensure all contractual obligations for cash value increases are being met. Document crediting calculations and maintain audit trails.
• Source: Top Class Actions

Community Dental Care data breach class action settlement

Community Dental Care reached a class action settlement following a data breach that exposed patient information. The settlement provides cash payments and credit monitoring benefits to affected individuals whose personal data was compromised in the breach.

• Compliance Action: Healthcare providers should review breach notification procedures and ensure they have adequate cybersecurity insurance coverage that includes settlement and credit monitoring costs. Verify that incident response plans account for class action litigation timelines.
• Source: Top Class Actions

Missouri Supreme Court blocks congressional redistricting map

The Missouri Supreme Court unanimously ruled that Secretary of State Denny Hoskins improperly rejected a referendum petition challenging HB 1, a new congressional map expected to give Republicans seven of the state's eight U.S. House seats. The court found that Missouri's constitution authorizes referendums on any act of the General Assembly with no applicable exceptions. The ruling prevents the state from using the new map unless voters approve it in the November 2026 election. Missouri has asked the U.S. Supreme Court to intervene, arguing the state supreme court's decision violates the elections clause by allowing 3.3% of voters to suspend a congressional map through a petition.

• Source: SCOTUSblog

DentaQuest sued over data breach affecting 15M patients

A class action lawsuit alleges DentaQuest is liable for a data breach that exposed the personally identifiable information of 15 million patients. The complaint claims the dental benefits administrator failed to implement adequate safeguards to protect patient data.

• Compliance Action: Healthcare organizations and dental benefits administrators should conduct security assessments of systems containing PHI and PII. Review vendor contracts to ensure liability and indemnification clauses adequately address breach scenarios involving large patient populations.
• Source: Top Class Actions

FanDuel lawsuit alleges exploitative design targeting problem gamblers

A Pennsylvania resident filed a class action against FanDuel alleging its sports gambling apps are designed to be addictive and exploit users' vulnerabilities through targeted promotions. The lawsuit claims the platform uses algorithms and marketing tactics that specifically target users showing signs of problem gambling behavior.

• Source: Top Class Actions

Privacy Developments

Berlin investigates second data leak after ransomware attack

German authorities are investigating a new trove of data stolen from Berlin's government network after hackers published login credentials and other information over the weekend. The leak follows a cyberattack discovered in mid-August that compromised two Berlin ministries responsible for urban development, housing, transport, mobility, climate protection, and the environment. The Rhysida ransomware group claimed responsibility for stealing 5.79 terabytes of data, including contracts, emails, passwords, and classified information. Berlin confirmed receiving an extortion demand but refused to pay. The newly released data includes login credentials, names, addresses, dates of birth, bank information, email addresses, telephone numbers, correspondence with government agencies, and copies of submitted documents. Germany's Federal Office for Information Security (BSI) warned Friday about a cyberattack campaign linked to the same financially motivated hackers behind Rhysida, involving malware known as LoremIpsumLoader or AxolotLoader.

• Compliance Action: Government agencies and organizations handling sensitive citizen data should immediately audit access control systems for compromised credentials, implement mandatory password resets for potentially affected accounts, and review incident response plans to ensure rapid containment when initial breaches are detected. Verify that security monitoring can detect lateral movement between different agency systems.
• Source: The Record

Compliance Takeaways

• Healthcare breach preparedness: Review cybersecurity insurance policies to ensure coverage includes class action settlement costs, credit monitoring services, and legal defense expenses. The Community Dental Care and DentaQuest cases demonstrate the litigation risk following breaches.
• Insurance policy audits: Financial services firms should conduct audits of Direct Recognition Life policies and other complex financial products to verify all contractual obligations for interest crediting, dividends, and cash value increases are being met. Document all calculations and maintain audit trails.
• Credential security after breaches: Organizations experiencing data breaches must assume stolen credentials will be published and used. Implement immediate password resets, enable multi-factor authentication on all accounts, and monitor for unauthorized access attempts using compromised credentials.
• Government data protection: Public sector entities should segment networks between different agencies to prevent lateral movement during cyberattacks. The Berlin breach affecting multiple ministries shows the risk of interconnected government systems.
• Ransomware response posture: Establish and document no-payment policies before ransomware incidents occur. Berlin's public refusal to pay demonstrates the importance of having executive-level commitment to this position in advance of an attack.