ARcare $3.9 Million Data Breach Settlement — $100 Cash or Up to $5,000, Claim by Jan. 7, 2027
PublishedOctober 21, 2026
People living in the U.S. who were sent a notice that their information may have been involved in the ARcare, Inc. data breach of January 18 to February 24, 2022 may qualify to claim an estimated $100, or up to $5,000 in documented losses, from the ARcare data breach class action settlement. Claims close January 7, 2027.
Claims are open in the $3.9 million ARcare, Inc. data breach settlement. The deadline is January 7,
2027: online claims are due by 11:59 p.m. Central Time that day, and mailed claim forms must be
postmarked by that date. The court granted preliminary approval on August 3, 2026, and the final
approval hearing is set for January 28, 2027. No final approval order had been entered and no
payment date had been announced as of October 21, 2026.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
StatusClaims Openpreliminary approval August 3, 2026 · final approval hearing Jan. 28, 2027
Claim DeadlineJanuary 7, 202711:59 p.m. Central Time online · postmarked by this date if mailed
Estimated Payout$100 or up to $5,000Estimated $100 cash, or up to $5,000 in documented losses · plus one year of medical data monitoring · $3.9M fund
Proof RequiredNo — for the $100 optionThe online form opens on name and address with no Class Member ID or PIN · documented-loss claims need records
What Changed Recently?
Claims opened when the settlement administrator, Verita Global, began sending notice and launched the
settlement website. U.S. District Judge Brian S. Miller of the Eastern District of Arkansas granted
preliminary approval on August 3, 2026, in Hale, et al. v. ARcare, Inc., No. 3:22-cv-00117-BSM.
Notice was then held up: on September 3, 2026, both sides told the court that the administrator needed
a qualified protective order before it could carry out the notice plan, a step that governs how
protected health information can be handled. On September 11, 2026, the court tied the notice date to
that protective order and moved the final approval hearing from December 3, 2026 to January 28, 2027.
ARcare denies the allegations and denies any wrongdoing or liability. It agreed to settle to avoid the
cost and disruption of further litigation, and the settlement is not an admission of fault.
Who Qualifies?
The settlement class is all living individuals residing in the United States who were sent a notice
of the ARcare data incident saying their private information may have been affected. According to the
notice, about 345,000 people received one. The class turns on having been sent that breach notice,
not on having lost money.
Excluded from the class are ARcare’s directors and officers, government entities, and the judge
assigned to the case, the judge’s immediate family and court staff.
How Much Can You Get?
ARcare is paying $3,900,000 into a non-reversionary settlement fund. The fund first covers settlement
administration costs and any attorneys’ fees, costs and service awards the court approves. Class
Counsel will ask for fees of up to one-third of the fund ($1.3 million), up to $50,000 in expenses,
and service awards of up to $2,500 for each class representative. What remains is the net settlement
fund, and each class member who files a valid claim chooses one cash option:
Cash Payment A — Documented Losses: reimbursement of up to $5,000 for actual, documented,
unreimbursed losses that were more likely than not caused by the breach and incurred after it.
Cash Payment B — Alternate Cash: a cash payment estimated at $100.
Either cash option can be paired with Medical Data Monitoring: one year of CyEx Medical Shield
Complete, which includes credit monitoring with one bureau, monitoring of health insurance plan and
beneficiary IDs, medical records and other health identifiers, dark web monitoring, real-time alerts,
victim assistance and up to $1,000,000 in identity theft insurance.
The $100 figure is an estimate, not a fixed amount. The net fund pays monitoring first, then
documented-loss claims, then the alternate cash payments. If money is left over, cash payments go up;
if claims exceed the fund, they go down, by the same percentage for everyone.
What Proof or Notice ID Is Required?
None for the $100 alternate cash payment or for medical data monitoring. The online claim form opens
directly on the claimant information section, asking for first and last name, address, city, state,
ZIP code and country, with no Class Member ID or PIN screen in front of it. The printable claim form
has a space for the Class Member ID from the notice but marks it “if available,” so it is optional.
An email address is required for anyone who selects medical data monitoring, because the activation
code is sent by email.
The documented-loss option does require proof. Claimants list each loss with its date, amount and how
it relates to the breach, and attach records such as account statements, letters from banks or
government agencies, invoices or receipts. A personal statement can add context but does not count as
documentation on its own, and losses already reimbursed by another source, including an identity
protection product, are not eligible. Every claimant signs a certification under penalty of perjury,
and the administrator can audit claims and send a notice of deficiency asking for more information.
What Is the Deadline?
Claims are due January 7, 2027. An online claim must be submitted by 11:59 p.m. Central Time that day;
a paper claim form must be postmarked no later than January 7, 2027. Each class member may file only
one claim.
Requests to be excluded and objections are due 60 days after the notice date, which is 30 days earlier
than the claim deadline. Counting back from the January 7, 2027 claim deadline, that works out to
December 8, 2026; the Important Dates page on the settlement website lists the official date. An
exclusion request has to be mailed, personally signed, and include the person’s name, address, phone
number and email address, if any, with a statement asking to be excluded. Someone who opts out gets no
settlement benefits and keeps the right to bring their own claim. Objections go to the court, with
copies to the lawyers and the administrator, and only class members who stay in the settlement can
object.
How Do You Take Action?
Claims are filed through the File a Claim link on the
ARcare Data Settlement website,
which opens the administrator’s online claim form. The form takes contact details, the choice of Cash
Payment A or Cash Payment B, the optional medical data monitoring election, the loss table for
documented claims and a signature. A printable claim form is also posted on the settlement website for
anyone who prefers to mail one. The settlement agreement, notice and court orders are on the site’s
Settlement Documents page.
Questions about a specific claim go to Verita Global through the contact options listed on the
settlement website. The notice asks class members not to contact the court or the clerk’s office about
the settlement.
What Happens Next?
Class Counsel’s request for attorneys’ fees, expenses and service awards is due at least 14 days
before the opt-out and objection deadline, and the motion for final approval is due at least 14 days
before the hearing. The final approval hearing is scheduled for January 28, 2027, at 10:00 a.m. before
Judge Miller. The court can move the hearing without new notice, and any schedule change is posted on
the settlement website.
Final approval is not guaranteed. If the court approves the settlement, the administrator distributes
benefits within 30 days after the Effective Date, which is the day after the final approval order if
no one objects, or 30 days after the order or the end of any appeals if someone does. At that point
class members with valid claims are emailed to choose an electronic payment or a paper check, and
monitoring activation codes go out by email. No payment date had been announced as of October 21, 2026.
What the Lawsuit Alleges
ARcare is a health care provider based in Augusta, Arkansas. According to the settlement agreement,
it experienced a data security incident on February 24, 2022 that disrupted its computer systems, and
its investigation found that an unauthorized actor may have accessed or taken data between January 18
and February 24, 2022. The information involved included Social Security numbers, driver’s license or
state ID numbers, dates of birth, financial account information, medical treatment and prescription
information, medical diagnoses or conditions, and health insurance information.
The first class action was filed on May 10, 2022, and four more followed in the same federal court
before they were consolidated. The consolidated complaint, filed June 2, 2023, asserts negligence,
breach of implied contract, unjust enrichment and breach of fiduciary duty, and seeks declaratory and
injunctive relief. The plaintiffs allege that ARcare failed to adequately protect the information in
its systems. ARcare denies those claims, and the court has not ruled for either side on the merits.
The case moved slowly because of an early fight over who the defendant should be. In July 2023 ARcare
asked the court to substitute the United States as the defendant or, alternatively, to dismiss the
case. The court denied that motion on March 8, 2024. ARcare appealed, the U.S. Court of Appeals for the
Eighth Circuit affirmed on February 13, 2026, and it denied rehearing on May 6, 2026. The parties then
mediated with retired Judge Wayne Andersen and reached this settlement. As part of it, ARcare will give
Class Counsel a written declaration describing the security measures it put in place after the
incident, paid for separately from the settlement fund.
Class members who stay in the settlement release their claims against ARcare and its related parties
arising from the data incident, whether or not they file a claim.
Sources and Verification
This page is based on the court record and the official settlement website:
The Settlement Agreement, with the proposed email, postcard and long-form notices and the claim form (ECF No. 63-2, filed July 30, 2026), and the plaintiffs’ unopposed motion for preliminary approval.
The Order granting preliminary approval (ECF No. 64, August 3, 2026), embedded below.
The parties’ joint motion to amend the notice and settlement deadlines (ECF No. 65, September 3, 2026) and the order granting it (ECF No. 67, September 11, 2026).
OpenClassActions.com is a consumer news and information site, not a law firm. This article is general
information about the ARcare data breach settlement. It is not legal advice, and reading it does not
create an attorney-client relationship.
Questions
Can someone claim both the $100 payment and documented losses from the ARcare settlement?
No. The claim form allows one cash option: either Cash Payment A for up to $5,000 in documented losses or Cash Payment B, the estimated $100 alternate cash payment. Medical Data Monitoring is separate and can be added to either cash option.
What losses count toward the ARcare settlement’s $5,000 documented-loss payment?
The settlement gives unreimbursed losses from fraud or identity theft as examples. Each loss has to be an actual out-of-pocket loss that was more likely than not caused by the breach, incurred after it, and not already reimbursed by another source, such as a bank or an identity protection product. Account statements, letters from financial institutions or government agencies, invoices and receipts are the kinds of records the claim form lists; a personal statement alone is not enough.
Is the ARcare $100 payment guaranteed?
No. The $100 is an estimate. After fees and costs, the net fund pays medical data monitoring first, then documented-loss claims, then the alternate cash payments, and cash amounts are raised or reduced by the same percentage depending on how many valid claims are filed. Nothing is paid unless the court grants final approval.
How will ARcare settlement payments be sent?
After final approval, the settlement administrator emails class members with valid claims to choose an electronic payment or a paper check, and they have 90 days to choose. Anyone who does not choose, or whose electronic payment fails, is sent a paper check at their last known address. Checks have to be cashed within 90 days.
Why did the ARcare data breach case take four years to settle?
ARcare asked the court in 2023 to substitute the United States as the defendant or, alternatively, to dismiss the case. The court denied that motion in March 2024, ARcare appealed, and the U.S. Court of Appeals for the Eighth Circuit affirmed in February 2026 and denied rehearing in May 2026. The parties then went to mediation and reached this settlement.
What happens to money left in the ARcare settlement fund?
The fund is non-reversionary, so none of it returns to ARcare once the settlement takes effect. Money still left after uncashed checks and undeliverable payments are accounted for goes, with the court’s approval, to Legal Aid of Arkansas.
Preliminary Approval Order
For more class actions keep scrolling below.
Settlement Amount
$3,900,000
Case Title
Hale, et al. v. ARcare, Inc.
Case Number
3:22-cv-00117-BSM
Court
U.S. District Court, Eastern District of Arkansas (Northern Division)
Final Approval Hearing
January 28, 2027 at 10:00 AM Judge Brian S. Miller · date may change
Baptist Health Drew County Data Breach Settlement: Up to $4,000 in documented fraud losses, plus credit monitoring, for people affected by the 2024 Arkansas hospital breach. See who qualifies →
Innovative Renal Care Data Breach Settlement: An estimated $100 or up to $5,000 in documented losses for people notified of the February 2024 breach. See who qualifies →
Roseland Community Hospital Data Breach Settlement: An estimated $50 or up to $5,000 in documented losses for people notified of the hospital’s June 2024 breach. See who qualifies →
Covenant Health Data Breach Settlement: An estimated $75 or up to $5,000 in documented losses from a $2 million fund. See who qualifies →
Hot Data Breaches: Every data breach settlement and investigation OCA is tracking. View all →