Published
August 25, 2026
This settlement resolves claims over an August 2025 cyberattack in which a third party accessed University of Hawaii Cancer Center servers supporting research at its epidemiology division, exposing names, Social Security numbers and driver's license numbers. If you were notified, you can take an estimated $50 with no documentation at all, or instead claim up to $5,000 in documented losses — and either way you can enroll in a year of medical data monitoring.
Current Status
Claims are open. The deadline to file is November 2, 2026, online or postmarked. The deadlines to opt out or to object come two weeks earlier, on October 19, 2026. The Court has scheduled a Final Approval Hearing for November 4, 2026 at 9:00 a.m. in Honolulu — two days after the claim window shuts — and the settlement has not been approved yet. No payment date has been announced: the Notice says benefits are provided only after the settlement is approved and becomes final, and that this may take time. If a notice reached you by email or mail, it carries the Unique ID and PIN you need to file online.
Status
Claims Open
final approval hearing November 4, 2026 in Honolulu
Claim Deadline
November 2, 2026
online or postmarked · opting out and objecting close earlier, on October 19
Estimated Payout
$50, or up to $5,000
the two cash options are alternatives · the $50 can adjust up or down pro rata · a year of medical data monitoring comes with either
Proof Required
Yes
Unique ID and PIN from your notice to file online · the $50 option itself needs no documentation
What Changed Recently?
The settlement is newly open to claims. The University of Hawaii has agreed to resolve In re University of Hawaiʻi Data Breach Litigation, Civil No. 1CCV-26-0000280, before the Honorable Steven Nichols in the First Judicial Circuit Court for the State of Hawaii, and the Court has authorized notice to the class. Epiq is administering the settlement, and the claim portal, the notice, the claim form and the settlement agreement are live on the official settlement website.The University denies any wrongdoing whatsoever. The Notice is emphatic on this point: no court or other judicial body has made any judgment or determination that the University did anything wrong, and the Court has made no determination that any law was violated. Both sides agreed to settle to avoid the risk, cost and time of continuing the lawsuit.
What the Case Is About
According to the Notice, on or about August 31, 2025 a third party unlawfully accessed specific University of Hawaii Cancer Center servers — the ones supporting research operations at the Cancer Center's epidemiology division. Files containing Private Information were accessed.The impacted information was names, Social Security numbers, driver's license numbers, and research-related Private Information.
One clarification in the Notice deserves to be pulled out, because it answers the question most people in this class will have first. The Notice states that the affected data was contained in research files and was not part of the medical records for patients treated at or in conjunction with the Cancer Center. So this was not a clinical records breach: diagnoses, treatment notes and the rest of a patient chart are not described as having been touched.
That does not make it minor. Social Security numbers and driver's license numbers are the two most directly exploitable identifiers a person has — together they are enough to open accounts, file fraudulent returns or obtain identification in someone else's name. The distinction is about what kind of exposure this is, not how serious it is, and it is worth understanding before deciding whether you have losses worth documenting.
Who Qualifies?
The Settlement Class is all living individuals in the United States who were notified that their Private Information was potentially compromised in the Data Incident.The test is the notice, not the geography. Although the case is in a Hawaii state court and the incident happened at a Hawaii institution, the class is defined nationwide with no residency requirement — a research participant or former patient who has since moved to the mainland is still a class member if they were notified. Equally, living in Hawaii or having been treated at the Cancer Center does not by itself put you in the class; being notified does.
Three groups are excluded: the judge presiding over the action and immediate family members for whom participating would create a conflict; the University itself, along with its affiliates, subsidiaries, successors, predecessors, any entity it controls, and its current officers and members of the Board of Regents plus their immediate family where participation would create a conflict; and anyone who submits a valid exclusion request before the opt-out deadline.
How Much Can You Get?
The Settlement Agreement provides a $3,500,000.00 Settlement Fund. That fund pays all valid claims, all settlement administration costs, and any attorneys' fees, costs and service awards the Court approves.- Cash Payment A — extraordinary documented losses, up to $5,000. Reimbursement for reasonably documented losses that can be reasonably traced to the Data Incident. The Notice frames these as losses related to fraud or identity theft.
- Cash Payment B — alternate cash, estimated at $50. Offered as an alternative to Cash Payment A, with no documentation required.
- Medical data monitoring — one year of CyEx Medical Shield Pro. Every Settlement Class Member may claim it, and the Notice offers it in addition to a cash payment rather than instead of one.
The two cash options are alternatives, so the choice is one or the other. The monitoring sits outside that choice and can be claimed alongside either.
The $50 figure comes with a feature worth reading twice, because it runs the opposite way from the usual warning. The Notice says Cash Payment B may be subject to a pro rata increase if the value of valid claims does not use up the entire Net Settlement Fund — as well as a pro rata decrease if valid claims exceed it — with any adjustment applied on an equal percentage basis. Most settlements only tell you your payment might shrink. Here the same mechanism can push it up, which is why the Notice calls $50 an estimate rather than a fixed amount. Our explainer on pro rata distribution covers how that arithmetic works. The Notice does not state how many people were notified, so which direction the adjustment runs cannot be worked out from the public documents.
There is also a safety net on the documented tier. The Notice states that if you do not submit reasonable documentation supporting a loss, or if the Settlement Administrator finds your Claim Form invalid and you do not cure it, your Claim Form will be processed as if you had elected Cash Payment B. A documented claim that does not hold up therefore lands on the estimated $50 rather than on nothing — which makes attempting the larger tier close to risk-free if you have anything to document.
Expenses already reimbursed from another source cannot be claimed. The Notice specifically includes compensation provided in connection with the credit monitoring and identity theft protection product the University offered with its original notification letter.
What Proof Is Required?
Filing online requires the Unique ID and PIN printed on the Notice you were sent by email or mail. The claim page is a login screen, so those credentials are not optional there — which is why this page treats the settlement as Proof Required: Yes even though the $50 option asks for no documentation.Past that credential, the burden depends on which cash option you pick:
- Cash Payment B, the estimated $50: no documentation.
- Cash Payment A, up to $5,000: reasonable documentation of the losses.
The Notice gives telephone records, correspondence including emails, and receipts as examples of reasonable documentation, and is explicit about the limit: personal certifications, declarations or affidavits from a class member do not constitute reasonable documentation. A written statement may be included to give clarification, context or support to other documentation, but it cannot carry the claim alone.
The claim instructions add two practical points. Supporting documentation should be clear, readable copies, because it will not be returned to you. And claims may be audited — the administrator can ask for additional information before processing a Claim Form — so keep copies of everything you submit. Filing online also produces a confirmation email with a confirmation code, which is worth keeping.
If you never received a Notice or have lost it, the settlement website directs you to contact the Settlement Administrator in writing for help. A printable Claim Form can also be downloaded from the official website and returned by mail with any supporting documentation.
What Are the Deadlines?
Three dates, and the compression at the end is unusual:- October 19, 2026 — opt out. A written exclusion request must be mailed to the Settlement Administrator, postmarked by this date, carrying your name, address, telephone number and email address, your personal physical signature, the case name and number, and a statement that you want to be excluded. You cannot opt out by telephone or email, and mass or class exclusion requests filed on behalf of multiple class members without each individual's signature will not be allowed.
- October 19, 2026 — object. An objection must be postmarked by this date and sent to four places: the Clerk of Court, Class Counsel, Defendant's Counsel and the Settlement Administrator.
- November 2, 2026 — submit a claim. Online by this date, or mailed to the Settlement Administrator postmarked by this date.
The claim deadline falls two days before the November 4 Final Approval Hearing. That ordering matters practically: waiting to see whether the Court approves the settlement before deciding to file is not possible, because the window closes first.
The Notice itself carries a postmark warning worth heeding, and it is unusual for a settlement notice to bother. Mail is often not postmarked the day it goes into a mailbox — postmarks happen when mail reaches a processing facility — so the Notice recommends mailing at least a week before the deadline, getting a manual postmark in person at a post office, or sending by Certified Mail. On top of that, the notice and FAQ describe mailed claims as needing to be postmarked by November 2, while the claim-instructions page on the settlement website describes them as needing to be received by then. The two are not the same standard, and the safe course is to treat the earlier one as binding and mail well ahead — or simply file online.
The objection requirements are demanding, and one goes further than most. Beyond your grounds and any legal support, an objector must disclose how many times they have objected to a class action settlement in the past five years — with the caption of each case and copies of any trial and appellate orders ruling on those objections — the same disclosure for their lawyer and the lawyer's firm, the identity of all counsel representing them and whether those counsel will appear, a list of anyone who will testify in support, and whether the objector or their lawyer will appear or testify. Your own signature is required; a lawyer's alone is not sufficient. The Notice also states that Class Counsel and Defendant's Counsel may conduct limited discovery on any objector or objector's counsel, including taking depositions and propounding document requests. Objecting here is not a low-effort gesture.
Objecting and opting out are mutually exclusive: you cannot object if you have excluded yourself, because the settlement no longer affects you. Our glossary entry on opting out of a class action covers what that choice trades away.
How Do You File?
Claims go through the official settlement website, UH Data Settlement.com, run by Epiq. Log in with the Unique ID and PIN from your Notice, verify your identity as a class member, choose the documented-loss claim or the alternate cash payment, upload any supporting documentation, and claim the medical data monitoring.If you prefer paper, the same site hosts a downloadable Claim Form to complete, sign, date and mail to the Settlement Administrator with any supporting documentation. Given the postmark caveat above, filing online is the lower-risk route this close to the deadline. Filing is free, and class members are not charged for Class Counsel's services.
Who Pays the Fees
The fund does, which means fees and awards come out of the same pot as class payments. The Court appointed Robert M. Hatch and Margery S. Bronster of Bronster Fujichaku Robbins, and Caroline Herter of Kopelowitz Ostrow, P.A., as Class Counsel. They will apply for up to one-third of the Settlement Fund — $1,166,666.67 — plus reimbursement of costs, and for service awards of up to $2,000.00 for each of the class representatives. The Notice states that if awarded, all of it is paid from the Settlement Fund.Subtracting the maximum fee request from the $3,500,000.00 fund leaves roughly $2.33 million before costs, service awards and administration expenses come out. That is our arithmetic on the figures in the Notice, not a projection from the administrator, and the Court may award less than what is requested — the Notice says so directly. Whatever is left is the Net Settlement Fund that the pro rata adjustment described above works against.
What You Give Up
Staying in the Settlement Class means giving up the right to sue over claims associated with the Data Incident. The release runs broadly here: the Notice says the University, the State of Hawaii, and their respective affiliates all receive releases from the Released Claims. Section XII of the Settlement Agreement sets out the detail, and the agreement is posted on the official settlement website.Doing nothing does not avoid that release. A class member who never files still gives up those claims and receives no cash and no monitoring — the only way to keep the right to sue is to opt out by October 19, 2026.
What Happens Next?
At the November 4, 2026 hearing the Court will consider whether the settlement is fair, reasonable and adequate, and will decide whether to grant final approval and rule on the application for attorneys' fees, costs and service awards. Nobody is required to attend — the Notice says Class Counsel will answer the Court's questions, and that a written objection filed by the deadline will be considered whether or not the objector appears.The Notice cautions that the hearing's date and time may change without further notice to the class, and that the Court may decide to hold it by videoconference or telephone, so the settlement website is the place to confirm before relying on it.
Benefits are distributed only if the Court approves the settlement and after any appeals are resolved. A hearing being held is not the same as approval being granted, and approval being granted is not the same as payments being released. The Notice asks class members to be patient and offers no payment date.
Class Action Summary
| Case Title | In re University of Hawaiʻi Data Breach Litigation |
|---|---|
| Case Number | Civil No. 1CCV-26-0000280 |
| Court | First Judicial Circuit Court for the State of Hawaii (Hon. Steven Nichols) |
| Defendant | University of Hawaii |
| Incident | August 31, 2025 unauthorized access to UH Cancer Center epidemiology research servers |
| Data Involved | Names, Social Security numbers, driver's license numbers and research-related private information — the Notice says not patient medical records |
| Class Scope | Nationwide — all living individuals in the U.S. notified of the incident |
| Settlement Fund | $3,500,000.00 |
| Cash Benefit | An estimated $50 with no documentation, or up to $5,000 documented — not both |
| Monitoring | 1 year CyEx Medical Shield Pro medical data monitoring |
| Claim Deadline | November 2, 2026 |
| Opt-Out / Object By | October 19, 2026 |
| Final Approval Hearing | November 4, 2026 at 9:00 AM (Honolulu) |
| Administrator | Epiq |
| Official Website | UH Data Settlement.com |
Sources and Verification
• Official settlement website — UH Data Settlement.com• Notice of Proposed Class Action Settlement (PDF)
• The settlement website's FAQ page and Submit a Claim instructions, and the downloadable Claim Form
• In re University of Hawaiʻi Data Breach Litigation, Civil No. 1CCV-26-0000280 (1st Cir. Ct. Haw.) — Settlement Agreement posted on the official website
• FTC — IdentityTheft.gov, reporting and recovery steps
Questions
Were my medical records taken?
The Notice says no. It states that the affected data was contained in research files and was not part of the medical records for patients treated at or in conjunction with the University of Hawaii Cancer Center. What the Notice does say was impacted is names, Social Security numbers, driver's license numbers, and research-related Private Information. That is still serious — Social Security numbers and driver's license numbers are the core material for identity theft — but it is a different exposure from a clinical records breach.
Could the $50 payment go up rather than down?
Yes, and this settlement says so explicitly, which is unusual. The Notice states that Cash Payment B may be subject to a pro rata increase if the value of valid claims does not use the entire Net Settlement Fund, or a pro rata decrease if valid claims exceed it, with any adjustment applied on an equal percentage basis. Most settlements only warn about reduction. The Notice does not state how many people were notified, so which direction the adjustment runs cannot be worked out from the public documents.
Can I claim both cash options?
No. The Notice presents Cash Payment B as an alternative to Cash Payment A, so you claim documented losses up to $5,000 or the estimated $50, not both. The medical data monitoring is separate: the Notice offers it in addition to a cash payment, so every Settlement Class Member can claim one year of CyEx Medical Shield Pro alongside whichever cash option they choose.
What happens if my documented-loss claim is rejected?
It converts rather than failing outright. The Notice states that if you do not submit reasonable documentation supporting a loss, or if the Settlement Administrator determines your Claim Form is invalid and you do not cure it, your Claim Form will be processed as if you had elected Cash Payment B. Attempting the documented tier therefore risks little — a claim that does not hold up falls back to the estimated $50 rather than to nothing.
The claim deadline is only two days before the hearing. Does that matter?
It matters for planning, not for eligibility. Claims are due November 2, 2026 and the Final Approval Hearing is November 4, 2026, so the claim window closes before the Court decides whether to approve the settlement. Waiting to see how the hearing goes is not an option — anyone who does that has missed the deadline. The opt-out and objection deadlines close earlier still, on October 19.
What if I no longer have the Unique ID and PIN from my notice?
The online claim form opens on a login screen requiring the Unique ID and PIN printed on the emailed or mailed Notice. The settlement website says anyone who did not receive a Notice, or has lost theirs, should contact the Settlement Administrator in writing for assistance. A printable Claim Form can also be downloaded from the official website and returned by mail with any supporting documentation.
Official Settlement Notice
For more class actions keep scrolling below.
Settlement Amount
$3,500,000.00
fees, costs, service awards and administration are paid from the fund
Case Title
In re University of Hawaiʻi Data Breach Litigation
Case Number
Civil No. 1CCV-26-0000280
Court
First Judicial Circuit Court for the State of Hawaii
Final Approval Hearing
November 4, 2026 at 9:00 AM
Honolulu · may move to videoconference or telephone · date and time may change
Administrator
Epiq
Official Website
UH Data Settlement
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
