Data Breach · Claims Open

ARcare $3.9 Million Data Breach Settlement — $100 Cash or Up to $5,000, Claim by Jan. 7, 2027

Published October 21, 2026

People living in the U.S. who were sent a notice that their information may have been involved in the ARcare, Inc. data breach of January 18 to February 24, 2022 may qualify to claim an estimated $100, or up to $5,000 in documented losses, from the ARcare data breach class action settlement. Claims close January 7, 2027.

Digital padlock on a dark blue circuit background

Current Status

Claims are open in the $3.9 million ARcare, Inc. data breach settlement. The deadline is January 7, 2027: online claims are due by 11:59 p.m. Central Time that day, and mailed claim forms must be postmarked by that date. The court granted preliminary approval on August 3, 2026, and the final approval hearing is set for January 28, 2027. No final approval order had been entered and no payment date had been announced as of October 21, 2026.

Status Claims Open preliminary approval August 3, 2026 · final approval hearing Jan. 28, 2027
Claim Deadline January 7, 2027 11:59 p.m. Central Time online · postmarked by this date if mailed
Estimated Payout $100 or up to $5,000 Estimated $100 cash, or up to $5,000 in documented losses · plus one year of medical data monitoring · $3.9M fund
Proof Required No — for the $100 option The online form opens on name and address with no Class Member ID or PIN · documented-loss claims need records

What Changed Recently?

Claims opened when the settlement administrator, Verita Global, began sending notice and launched the settlement website. U.S. District Judge Brian S. Miller of the Eastern District of Arkansas granted preliminary approval on August 3, 2026, in Hale, et al. v. ARcare, Inc., No. 3:22-cv-00117-BSM. Notice was then held up: on September 3, 2026, both sides told the court that the administrator needed a qualified protective order before it could carry out the notice plan, a step that governs how protected health information can be handled. On September 11, 2026, the court tied the notice date to that protective order and moved the final approval hearing from December 3, 2026 to January 28, 2027.

ARcare denies the allegations and denies any wrongdoing or liability. It agreed to settle to avoid the cost and disruption of further litigation, and the settlement is not an admission of fault.

Who Qualifies?

The settlement class is all living individuals residing in the United States who were sent a notice of the ARcare data incident saying their private information may have been affected. According to the notice, about 345,000 people received one. The class turns on having been sent that breach notice, not on having lost money.

Excluded from the class are ARcare’s directors and officers, government entities, and the judge assigned to the case, the judge’s immediate family and court staff.

How Much Can You Get?

ARcare is paying $3,900,000 into a non-reversionary settlement fund. The fund first covers settlement administration costs and any attorneys’ fees, costs and service awards the court approves. Class Counsel will ask for fees of up to one-third of the fund ($1.3 million), up to $50,000 in expenses, and service awards of up to $2,500 for each class representative. What remains is the net settlement fund, and each class member who files a valid claim chooses one cash option: Either cash option can be paired with Medical Data Monitoring: one year of CyEx Medical Shield Complete, which includes credit monitoring with one bureau, monitoring of health insurance plan and beneficiary IDs, medical records and other health identifiers, dark web monitoring, real-time alerts, victim assistance and up to $1,000,000 in identity theft insurance.

The $100 figure is an estimate, not a fixed amount. The net fund pays monitoring first, then documented-loss claims, then the alternate cash payments. If money is left over, cash payments go up; if claims exceed the fund, they go down, by the same percentage for everyone.

What Proof or Notice ID Is Required?

None for the $100 alternate cash payment or for medical data monitoring. The online claim form opens directly on the claimant information section, asking for first and last name, address, city, state, ZIP code and country, with no Class Member ID or PIN screen in front of it. The printable claim form has a space for the Class Member ID from the notice but marks it “if available,” so it is optional. An email address is required for anyone who selects medical data monitoring, because the activation code is sent by email.

The documented-loss option does require proof. Claimants list each loss with its date, amount and how it relates to the breach, and attach records such as account statements, letters from banks or government agencies, invoices or receipts. A personal statement can add context but does not count as documentation on its own, and losses already reimbursed by another source, including an identity protection product, are not eligible. Every claimant signs a certification under penalty of perjury, and the administrator can audit claims and send a notice of deficiency asking for more information.

What Is the Deadline?

Claims are due January 7, 2027. An online claim must be submitted by 11:59 p.m. Central Time that day; a paper claim form must be postmarked no later than January 7, 2027. Each class member may file only one claim.

Requests to be excluded and objections are due 60 days after the notice date, which is 30 days earlier than the claim deadline. Counting back from the January 7, 2027 claim deadline, that works out to December 8, 2026; the Important Dates page on the settlement website lists the official date. An exclusion request has to be mailed, personally signed, and include the person’s name, address, phone number and email address, if any, with a statement asking to be excluded. Someone who opts out gets no settlement benefits and keeps the right to bring their own claim. Objections go to the court, with copies to the lawyers and the administrator, and only class members who stay in the settlement can object.

How Do You Take Action?

Claims are filed through the File a Claim link on the ARcare Data Settlement website, which opens the administrator’s online claim form. The form takes contact details, the choice of Cash Payment A or Cash Payment B, the optional medical data monitoring election, the loss table for documented claims and a signature. A printable claim form is also posted on the settlement website for anyone who prefers to mail one. The settlement agreement, notice and court orders are on the site’s Settlement Documents page.

Questions about a specific claim go to Verita Global through the contact options listed on the settlement website. The notice asks class members not to contact the court or the clerk’s office about the settlement.

What Happens Next?

Class Counsel’s request for attorneys’ fees, expenses and service awards is due at least 14 days before the opt-out and objection deadline, and the motion for final approval is due at least 14 days before the hearing. The final approval hearing is scheduled for January 28, 2027, at 10:00 a.m. before Judge Miller. The court can move the hearing without new notice, and any schedule change is posted on the settlement website.

Final approval is not guaranteed. If the court approves the settlement, the administrator distributes benefits within 30 days after the Effective Date, which is the day after the final approval order if no one objects, or 30 days after the order or the end of any appeals if someone does. At that point class members with valid claims are emailed to choose an electronic payment or a paper check, and monitoring activation codes go out by email. No payment date had been announced as of October 21, 2026.

What the Lawsuit Alleges

ARcare is a health care provider based in Augusta, Arkansas. According to the settlement agreement, it experienced a data security incident on February 24, 2022 that disrupted its computer systems, and its investigation found that an unauthorized actor may have accessed or taken data between January 18 and February 24, 2022. The information involved included Social Security numbers, driver’s license or state ID numbers, dates of birth, financial account information, medical treatment and prescription information, medical diagnoses or conditions, and health insurance information.

The first class action was filed on May 10, 2022, and four more followed in the same federal court before they were consolidated. The consolidated complaint, filed June 2, 2023, asserts negligence, breach of implied contract, unjust enrichment and breach of fiduciary duty, and seeks declaratory and injunctive relief. The plaintiffs allege that ARcare failed to adequately protect the information in its systems. ARcare denies those claims, and the court has not ruled for either side on the merits.

The case moved slowly because of an early fight over who the defendant should be. In July 2023 ARcare asked the court to substitute the United States as the defendant or, alternatively, to dismiss the case. The court denied that motion on March 8, 2024. ARcare appealed, the U.S. Court of Appeals for the Eighth Circuit affirmed on February 13, 2026, and it denied rehearing on May 6, 2026. The parties then mediated with retired Judge Wayne Andersen and reached this settlement. As part of it, ARcare will give Class Counsel a written declaration describing the security measures it put in place after the incident, paid for separately from the settlement fund.

Class members who stay in the settlement release their claims against ARcare and its related parties arising from the data incident, whether or not they file a claim.

Sources and Verification

This page is based on the court record and the official settlement website:

OpenClassActions.com is a consumer news and information site, not a law firm. This article is general information about the ARcare data breach settlement. It is not legal advice, and reading it does not create an attorney-client relationship.

Questions

Can someone claim both the $100 payment and documented losses from the ARcare settlement?

No. The claim form allows one cash option: either Cash Payment A for up to $5,000 in documented losses or Cash Payment B, the estimated $100 alternate cash payment. Medical Data Monitoring is separate and can be added to either cash option.

What losses count toward the ARcare settlement’s $5,000 documented-loss payment?

The settlement gives unreimbursed losses from fraud or identity theft as examples. Each loss has to be an actual out-of-pocket loss that was more likely than not caused by the breach, incurred after it, and not already reimbursed by another source, such as a bank or an identity protection product. Account statements, letters from financial institutions or government agencies, invoices and receipts are the kinds of records the claim form lists; a personal statement alone is not enough.

Is the ARcare $100 payment guaranteed?

No. The $100 is an estimate. After fees and costs, the net fund pays medical data monitoring first, then documented-loss claims, then the alternate cash payments, and cash amounts are raised or reduced by the same percentage depending on how many valid claims are filed. Nothing is paid unless the court grants final approval.

How will ARcare settlement payments be sent?

After final approval, the settlement administrator emails class members with valid claims to choose an electronic payment or a paper check, and they have 90 days to choose. Anyone who does not choose, or whose electronic payment fails, is sent a paper check at their last known address. Checks have to be cashed within 90 days.

Why did the ARcare data breach case take four years to settle?

ARcare asked the court in 2023 to substitute the United States as the defendant or, alternatively, to dismiss the case. The court denied that motion in March 2024, ARcare appealed, and the U.S. Court of Appeals for the Eighth Circuit affirmed in February 2026 and denied rehearing in May 2026. The parties then went to mediation and reached this settlement.

What happens to money left in the ARcare settlement fund?

The fund is non-reversionary, so none of it returns to ARcare once the settlement takes effect. Money still left after uncashed checks and undeliverable payments are accounted for goes, with the court’s approval, to Legal Aid of Arkansas.

Preliminary Approval Order

Your browser does not support viewing PDFs inline. Download the PDF.


For more class actions keep scrolling below.
Settlement Amount $3,900,000
Case Title Hale, et al. v. ARcare, Inc.
Case Number 3:22-cv-00117-BSM
Court U.S. District Court, Eastern District of Arkansas (Northern Division)
Final Approval Hearing January 28, 2027 at 10:00 AM Judge Brian S. Miller · date may change
Administrator Verita Global, Inc.
Official Website ARcare Data Settlement

More Health Care Data Breach Settlements