Published
August 24, 2026
This settlement resolves claims over a June 2025 targeted cyberattack on the computer systems of Highlands Oncology Group, an Arkansas cancer care provider, in which files containing patient information were accessed. If you were sent notice, you can claim three years of medical data monitoring plus either a flat $50 or up to $4,250 in documented losses — but nothing is paid automatically, so a claim form is the only way to get any of it.
Current Status
Claims are open. A claim form must be submitted online or postmarked no later than October 22, 2026. There is an earlier date that is easy to miss: October 7, 2026 is the deadline both to exclude yourself and to object. The Court granted preliminary approval and has scheduled a final approval hearing for November 6, 2026 at 9:00 a.m. Central Time in Fayetteville, Arkansas — after claims close. No final approval order has been entered and no payment date had been announced as of August 24, 2026.
Status
Claims Open
Claim Deadline
October 22, 2026
Online or postmarked · opt-out and objection deadline is earlier, October 7, 2026
Estimated Payout
$50 or up to $4,250
Flat cash with no proof, or documented losses instead · plus 3 years of medical data monitoring for everyone who claims
Proof Required
Yes
LoginID and PIN from the mailed notice to file online
What Changed Recently?
The Circuit Court for Washington County, Arkansas authorized notice to the class, which opened the claim window and put the November 6, 2026 final approval hearing on the calendar. The case is In re Highlands Oncology Group Data Breach Litigation, Case No. 72CV-25-3420.The lawsuit alleges that during a June 2025 targeted cyberattack on Highlands Oncology's computer systems, certain files containing private information were accessed. According to the court-approved Notice, those files may have contained names, dates of birth, Social Security numbers, driver's license and state identification numbers, passport numbers, credit and debit card numbers, financial account numbers, medical treatment information, medical record numbers, patient account numbers, and health insurance policy information.
That combination is what makes this settlement's monitoring benefit unusual. Most data breach settlements offer credit monitoring, which watches for new accounts opened in your name. Here the exposure includes medical record numbers and health insurance policy information, so the settlement offers medical data monitoring instead — a different product aimed at a different kind of fraud.
Highlands Oncology denies that it did anything wrong, and the Court has not decided who is right. The parties agreed to settle to avoid the costs, risks, disruptions and uncertainties of continuing the case. Healthcare providers have produced a steady run of these settlements — the Tift Regional Health System settlement and the MCNA Dental settlement both turned on the same kind of patient-record exposure.
Who Qualifies?
The Court defined the Class as all individuals residing in the United States whose Private Information was compromised in the Data Breach on or around June 2025. This is a nationwide class rather than an Arkansas-only one — what matters is that your information was in the affected files, not where you live.The Notice states that Highlands Oncology's records indicate who the class members are, and that a class member may also have received an earlier notice directly from Highlands Oncology at the time of the incident.
The class excludes only three groups, which is a narrower carve-out than most breach settlements:
- All persons who are directors and officers of Highlands Oncology;
- Governmental entities; and
- The Judge assigned to the case, that Judge's immediate family, and Court staff.
How Much Can You Get?
The benefits come in two parts, and the relationship between them is the single most misread thing on pages like this: the monitoring and the cash are additive. The Notice states that all Settlement Class Members may claim Medical Data Monitoring and one of the two Cash Payment options. The choice is only between the two cash tiers.- Medical Data Monitoring. Three years of CyEx Medical Shield Complete, which carries $1 million of medical identity theft insurance and monitors for healthcare insurance ID exposure, Medical Record Number exposure, and unauthorized Health Savings Account spending. If something suspicious surfaces, the service provides access to a fraud resolution agent.
- Cash Payment A — Documented Losses. Up to $4,250 for actual, documented out-of-pocket losses from fraud or identity theft caused by the incident, covering things like losses from identity theft, fees for credit reports, credit monitoring or credit freezes and unfreezes, the cost of replacing IDs, and postage to contact banks by mail.
- Cash Payment B — Alternate Cash. A one-time $50 payment, with no proof or explanation required. You take this instead of Cash Payment A, not in addition to it.
Three limits apply to Cash Payment A and are worth reading before choosing it. The losses must have occurred between June 2, 2025 and October 22, 2026. You must send third-party proof such as bank statements or receipts; the Notice permits self-prepared notes to explain or support other proof, but states plainly that notes alone are not enough to make a valid claim. And you cannot claim anything already reimbursed by a third party.
One term here is genuinely favorable. Class Counsel will ask the Court to approve $400,000 in attorneys' fees and litigation costs, plus service awards of $1,500 for each class representative, and the Notice states that Highlands Oncology pays both. There is no common fund those amounts are carved out of, so they do not reduce what class members receive.
What Proof or Login ID Is Required?
Yes, filing requires an administrator-issued identifier. The online claim form is gated on the LoginID and PIN printed on the notice mailed to class members, and the login page will not proceed without both. That makes this a proof-required settlement even for the $50 tier, where no receipts or documentation are requested — the $50 needs no documentation, but it still needs the code from your notice.If you cannot locate your LoginID and PIN, the Notice states you can contact the Settlement Administrator with your full name and mailing address to request them. A printable claim form can also be downloaded from the settlement website and mailed instead, or requested from the administrator. Contact details are on the official settlement website.
Cash Payment A adds a second, heavier proof layer on top of that: third-party documentation of every loss you claim. Cash Payment B adds nothing beyond the login.
What Are the Deadlines?
Two dates matter, about two weeks apart:- October 7, 2026 — exclusion and objection. A request for exclusion must be postmarked by this date and mailed to the Settlement Administrator, containing the case name and number, your full name, mailing address, telephone number and email address, your personal signature, and the words "Request for Exclusion" or a clear equivalent. You may only exclude yourself, not anyone else. An objection has to be filed with the Clerk of Court by the same date, with copies mailed to the Settlement Administrator, Class Counsel and defense counsel, and it carries a longer checklist — including a description of every reason you object, any lawyer you have hired, any objections you or that lawyer filed in the past five years, any witnesses or documents you intend to present, whether you want to speak at the hearing, and your own signature.
- October 22, 2026 — claim deadline. Online submissions must be completed by this date; mailed claim forms, including supporting documentation, must be postmarked by it. This is the only route to any benefit.
Objecting and excluding are mutually exclusive: you can object only if you stay in, and a class member who opts out cannot object because the settlement no longer affects them. You can, however, object and still file a claim.
What Do You Give Up?
Class members who do not exclude themselves give up the right to be part of any other lawsuit against Highlands Oncology about the issues this settlement covers. The Releases section of the Settlement Agreement, Section XI, sets out the specific claims released; the agreement is posted on the official settlement website.This is the part that makes doing nothing the worst option. A class member who never files is still bound by that release — they simply receive no monitoring and no cash in exchange for it. Opting out is the only way to keep the right to sue on your own, and it has to be done by October 7, 2026.
How Do You Take Action?
Filing is done through the official Highlands Oncology settlement website, which hosts the online claim form login, a downloadable printable claim form, the full court-approved Notice, the Settlement Agreement, an important dates page and a contact page.To file online, log in with the LoginID and PIN from your notice and follow the steps. To file on paper, download the claim form, complete and sign it, attach supporting documentation if you are claiming documented losses, and mail it so that it is postmarked by October 22, 2026. Claim the monitoring on the same form — it is not sent automatically.
OpenClassActions is not the settlement administrator and cannot look up your LoginID, confirm whether Highlands Oncology's records list you, or tell you what your payment will be. Those answers come from the official settlement website.
What Happens Next?
The Court will hold the final approval hearing on November 6, 2026 at 9:00 a.m. Central Time at the Circuit Court for Washington County, Arkansas, in Fayetteville. It will decide whether to approve the settlement, how Class Counsel should be paid, whether to award the service awards, and will consider any objections. Attendance is optional — the Notice states that a timely filed objection is considered whether or not the objector appears. The Notice also warns that the date and time may change without further notice, so the settlement website is the place to confirm it.A hearing being held is not the same as approval being granted. If the Court does approve the settlement, the Notice states that payments will be distributed after final approval and after any appeals are resolved, and that it is not known whether appeals will be filed or how long they would take. No payment date had been announced as of August 24, 2026.
Sources and Verification
- Court-approved Notice of Proposed Class Action Settlement in In re Highlands Oncology Group Data Breach Litigation, Case No. 72CV-25-3420 (Cir. Ct. Washington Cnty., Ark.) — embedded below.
- Official settlement website, including its FAQ, important dates and important documents pages, which host the Settlement Agreement and the claim form.
- Case file for Case No. 72CV-25-3420, available from the office of the Clerk of the Court, Circuit Court for Washington County, Arkansas, in Fayetteville.
The Court appointed Mariya Weekes of Milberg PLLC and J. Gerard Stranch, IV of Stranch, Jennings & Garvey, PLLC as Class Counsel, and Simpluris is administering the settlement. Class members are not charged for that representation.
Note on a similarly named case: this settlement concerns Highlands Oncology Group in Arkansas and a June 2025 incident. It is unrelated to a separate settlement involving Highland Health Systems and a 2023 breach, which is a different company in a different state.
Questions
Can I claim the medical data monitoring and a cash payment?
Yes. The Notice states that all Settlement Class Members may claim Medical Data Monitoring and one of the two Cash Payment options. The monitoring and the cash are additive, not alternatives. What you have to choose between is Cash Payment A and Cash Payment B — you cannot take both.
Is anything paid automatically if I do not file a claim?
No. The Notice is explicit that submitting a valid and timely Claim Form is the only way to receive benefits or payments, and that a class member who does nothing receives no benefit while still giving up the released claims. Even the three years of medical data monitoring has to be claimed.
Should I take the $50 or file for documented losses?
Cash Payment B is a flat $50 with no proof or explanation required. Cash Payment A reimburses actual, documented out-of-pocket losses from fraud or identity theft up to $4,250, but only for losses incurred between June 2, 2025 and October 22, 2026, only with third-party proof such as bank statements or receipts, and not for anything already reimbursed by someone else. If your documented losses are under $50 or you have no third-party proof, the flat payment is the practical choice.
I lost the notice with my LoginID and PIN. Can I still file?
The online claim form requires the LoginID and PIN printed on the notice that was mailed to you. The Notice states that a class member who cannot locate them can contact the Settlement Administrator with their full name and mailing address to request them, and can also request a paper Claim Form. Contact details are on the official settlement website.
Do attorneys' fees come out of the class members' payments?
No. The Notice states that Class Counsel will ask the Court to approve $400,000 in attorneys' fees and litigation costs, and service awards of $1,500 for each class representative, and that Highlands Oncology pays both. Neither comes out of what class members receive.
Why is the opt-out deadline earlier than the claim deadline?
They are separate decisions on separate schedules. October 7, 2026 is the deadline to exclude yourself or to object. October 22, 2026 is the deadline to file a claim. A class member who is weighing whether to sue on their own has to decide roughly two weeks before claims close, because opting out after October 7 is not an option.
Official Settlement Notice
For more class actions keep scrolling below.
Settlement Amount
No aggregate fund
Benefits are paid per valid claim · fees and service awards paid separately by Highlands Oncology
Case Title
In re Highlands Oncology Group Data Breach Litigation
Case Number
72CV-25-3420
Court
Circuit Court for Washington County, Arkansas
Final Approval Hearing
November 6, 2026 at 9:00 AM CT
Fayetteville, Arkansas — the Notice warns the date and time may change without further notice
Administrator
Simpluris
Official Website
Highlands Oncology Settlement.com
