People named on the Settlement Class List for the June 2023 targeted cyberattack on Valley Oaks Health, Inc.’s computer systems may qualify to claim a one-time $40 cash payment with nothing to document, or instead up to $500 in ordinary out-of-pocket losses, up to $5,000 in extraordinary losses and up to $80 for lost time, with two years of CyEx Medical Shield Pro monitoring available either way. Claims close November 9, 2026, and unusually the deadlines to opt out and to object fall on that same day.
Current Status
Claims are open. The deadline to file is November 9, 2026, online or by mail with a postmark no later than that date. The deadlines to opt out and to object land on the same November 9, 2026 rather than weeks earlier, which is unusual and means the decision to stay in the class does not close ahead of the money. The Court has set a Final Approval Hearing for December 10, 2026 at 2:00 p.m. Eastern Time, and the settlement has not been approved yet. No payment date has been announced: the Notice says settlement payments are distributed if the Court grants final approval and after any appeals are resolved. If a notice reached you, it carries the Login ID and PIN that open the online claim form.Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Changed Recently?
The settlement is newly open to claims. Valley Oaks Health, Inc. has agreed to resolve In re: Valley Oaks Data Incident Litigation, Case No. 79D01-2403-PL-00032, in the Superior Court No. 1 for Tippecanoe, Indiana, and the Court has authorized notice to the class. Simpluris is administering it, and the claim portal, the long-form notice, the claim form and the settlement agreement are all live on the official settlement website.Valley Oaks denies that it did anything wrong, and the Court has not decided who is right. The Notice states that the parties agreed to settle to avoid the costs and risks, disruptions and uncertainties of continuing the litigation, and that the Court did not decide whether the plaintiffs or the defendant are right. No finding of liability has been made against the company.
Who Qualifies?
The Court defined the Class as all persons whose Private Information was potentially compromised as a result of the Incident and who are included on the Settlement Class List. Both halves of that definition matter, and the second one does most of the work: membership is not a judgment call about whether your information was in the files, it is a question of whether the administrator’s list has your name on it. The Login ID and PIN printed on the mailed notice are the practical signal, and the Notice says Valley Oaks’ records indicate a recipient is a class member entitled to benefits.The Notice also says class members may have received an earlier notice directly from Valley Oaks, separate from the court-authorized one. That earlier letter is not the claim notice and does not carry the credentials the claim form asks for.
Excluded from the Class are the Judge assigned to evaluate the fairness of the Settlement, Court personnel and their immediate family members; Valley Oaks, any entity in which Valley Oaks Health, Inc. has a controlling interest, any parent, subsidiary or entity it controls, and the affiliates, legal representatives, attorneys, heirs, predecessors, successors and assigns of Valley Oaks; and anyone found by a court of competent jurisdiction to be guilty under criminal law of initiating, causing, aiding or abetting the criminal activity behind the Incident, or who pleads nolo contendere to such a charge.
The lawsuit alleges that during the June 2023 targeted cyberattack on Valley Oaks’ computer systems, certain files containing private information were accessed. Our explainer on how data breach class actions work covers what these cases typically pay and what a release costs.
How Much Can You Get?
There is one branching decision on the claim form, and one benefit that sits outside it. The cash options are alternatives:- Alternative Cash Payment — $40. A one-time payment claimed instead of any other payments. The Notice says no proof or explanation is required.
- Ordinary Out-of-Pocket Losses — up to $500. Actual, documented, unreimbursed expenses caused by the Incident and incurred between June 8, 2023 and November 9, 2026.
- Extraordinary Out-of-Pocket Losses — up to $5,000. Money lost to identity theft or fraud, in the same June 8, 2023 to November 9, 2026 window, where the loss is not already covered by the ordinary tier.
- Lost Time — up to $80. Up to four hours at $20.00 per hour, with a brief description of how the time was spent.
The three documented tiers are described in the Notice as things a class member can claim together, and the $40 is described as a payment taken instead of any of them. So the decision is whether what the incident actually cost you comes to more than $40. For most people who never saw a fraudulent charge, it does not, and the $40 is the sensible claim; for anyone who bought a credit monitoring subscription, paid a bureau to freeze and unfreeze their credit, replaced a driver’s license, or spent an afternoon on the phone with a bank, it usually does.
The two-year medical monitoring benefit sits outside that choice. The Notice says all Settlement Class Members are eligible to enroll in Medical Monitoring Services and one or more of the cash payment options, so the coverage is not what the $40 trades away. It is CyEx Medical Shield Pro, with $1 million of medical identity theft insurance, monitoring for healthcare insurance ID exposure, Medical Record Number exposure and unauthorized Health Savings Account spending, and access to a fraud resolution agent if something surfaces. That is a different product from credit monitoring and a closer fit to a file that held patient account numbers and clinical information — the risk being watched for is someone else’s care being billed to your policy and ending up in your record.
There is no common settlement fund. The Notice discloses no total settlement amount, no aggregate cap on the cash benefits and no pro rata reduction clause, which is genuinely uncommon in a data breach settlement: the usual shape is a fixed pot whose published per-person figure shrinks once the claim count is known. Here the only ceilings stated anywhere in the official documents are the per-person ones, and the attorneys’ fees and service awards are paid by Valley Oaks separately rather than taken off the top of anything a class member receives.
One figure is stated two ways. The Notice and the settlement website’s FAQ page both describe the lost-time benefit as a maximum of $80.00 with no reference to any shared limit. The claim-form landing page on the same website adds a parenthetical that lost time combined with Ordinary Out-of-Pocket Losses is capped at $500.00 in total. The two readings only diverge for someone claiming close to $500 in ordinary losses and the full four hours; anyone in that position should raise it with the Settlement Administrator through the official settlement website before filing rather than assume the looser version.
The Notice Describes the Exposed Data Two Different Ways
The court-authorized Notice gives two different accounts of what was in the accessed files, and they do not overlap much. The summary on its first page says the files may have contained name, date of birth, Social Security number, patient account number, medical diagnosis and clinical information. Its answer to what the lawsuit is about instead lists Social Security number; driver’s license number; state identification card number or other government-issued identification number; account number; credit or debit card number together with a required security code; an access code or password permitting access to financial information; biometric data; DNA profile; and a username or email address together with a credential permitting access to an online account.The second list reads like the statutory definition of private information the complaint pleaded rather than a finding about these particular files, which is a common way for the two to diverge in a settlement notice. Neither list is presented as complete for any one person, and nothing in the Notice or on the settlement website says which categories applied to which class members.
For a reader deciding whether to bother filing, the practical effect is that the exposure could be clinical, financial or both, and the settlement’s monitoring benefit is aimed at the clinical half. Anyone who wants to know what was in their own file should ask the Settlement Administrator directly through the official settlement website — that is a question the published documents do not answer.
What Proof Is Required?
Filing online requires the Login ID and PIN printed on the notice sent to you. The settlement website says so on the claim form login screen: you must log in with your Login ID and PIN, and both are on the Notice. That is why this page treats the settlement as Proof Required: Yes even though the $40 Alternative Cash Payment itself asks for no documentation and no explanation.The paper route is looser. The same site hosts a downloadable Claim Form that can be printed, completed, signed and returned by mail with any supporting documentation. That is a real path for someone whose notice went astray, but an envelope is not an open online door, so it does not make this a no-proof settlement.
Past that credential, the documentation burden splits by benefit:
- Alternative Cash Payment, $40: nothing. The Notice states no proof or explanation is required.
- Medical Monitoring, two years: nothing beyond the claim form. The Notice states all Class Members are eligible to claim it.
- Ordinary Out-of-Pocket Losses, up to $500: proof such as receipts showing how much you spent, and showing the expense was because of the Incident.
- Extraordinary Out-of-Pocket Losses, up to $5,000: the same kind of proof, plus a showing that the theft or fraud was probably caused by the Incident, that the loss is not already covered by the ordinary tier, and that you tried to prevent the loss or recover the money, such as through insurance you already have.
- Lost Time, up to $80: a brief description of how the time was spent. Examples the Notice gives are changing passwords, investigating suspicious account activity and researching the Incident.
The documented tiers carry a limit worth reading twice: notes or papers you made yourself are not enough on their own. The Notice says they can explain or support other proof but cannot carry a claim by themselves. Expenses already reimbursed by a third party are out, and every claimed loss has to fall inside the June 8, 2023 to November 9, 2026 window.
What Are the Deadlines?
Three of the four dates are the same day, which is the opposite of the usual arrangement and worth noticing because it changes what a late reader can still do:- November 9, 2026 — submit a claim. Online by that date, or the completed and signed Claim Form with supporting documentation postmarked no later than that date.
- November 9, 2026 — opt out. A written Request for Exclusion carrying the case name and number, your full name, mailing address, telephone number and email address, your personal wet ink signature, and the words “Request for Exclusion” or a clear equivalent. Electronic and typed signatures are not sufficient, and you may exclude only yourself.
- November 9, 2026 — object. A complete objection filed with the Clerk of Court by that date, with a copy sent to the Settlement Administrator.
- December 10, 2026 — Final Approval Hearing. 2:00 p.m. Eastern Time in the Superior Court No. 1 for Tippecanoe, Indiana, in Lafayette.
On most settlements the exclusion deadline lands weeks before the claim deadline, and someone who reads their notice late finds the decision to leave the class already made for them by the calendar. That does not happen here. Our glossary entry on opting out of a class action covers what that choice trades away. Objecting does not cost you the money — an objector stays in the class and can still file a claim — while opting out means no settlement benefits at all.
Objecting demands considerably more than an opinion. Beyond the case name and number and your own contact details, the Notice requires information proving you are a class member, such as a notice you received; whether the objection applies only to you or to other class members as well; a clear description of every reason you object, with any legal support; the name, bar number and contact information of any lawyer you hired for the objection; the names, courts and civil action numbers of every other class action settlement you or your lawyer have objected to; whether you or your lawyer want to speak at the Final Approval Hearing; a full list of any witnesses or documents you plan to present there; and your own wet ink signature, which a lawyer’s signature cannot substitute for. The Notice says the objection must meet each of those requirements to be valid.
How Do You File?
Claims go through the official settlement website, Valley Oaks Data Settlement.com, administered by Simpluris. Log in to the claim form with the Login ID and PIN from your notice, then choose either the $40 Alternative Cash Payment or the documented tiers, and claim the two years of medical monitoring on the same form.If you prefer paper, the same site hosts a downloadable Claim Form that can be printed, completed and returned by mail with any supporting documentation, postmarked by November 9, 2026. Keep a copy of whatever you submit. Filing is free, and class members are not charged for Class Counsel’s services. If your contact information changes after you file, tell the administrator through the official settlement website.
Who Pays the Fees
Valley Oaks does, separately from anything class members receive. Class Counsel will ask the Court to approve $450,000.00 as reasonable attorneys’ fees and reimbursement of litigation costs, plus service award payments of $2,500.00 for each of the class representatives, and the Notice states that both amounts will be paid by Valley Oaks. The Court appointed Lynn A. Toops of CohenMalad, LLP as Class Counsel.That structure is the reason the per-person figures on this page are ceilings rather than estimates. On a common-fund settlement, fees and service awards come off the top of a fixed pot before any claimant is paid, which is why so many advertised flat payments shrink later. Nothing described in the Notice is deducted from what a class member gets here, and the Notice sets out no aggregate cap that could reduce a valid claim.
What You Give Up
Staying in the class means you cannot be part of any other lawsuit against Valley Oaks about the issues this settlement covers. The Notice points to the Releases section of the Settlement Agreement, Section V, as the definition of the claims given up, and directs class members to the Settlement Agreement itself for the text.A release in a data breach settlement normally reaches harm that has not surfaced yet. A fraudulent medical bill that appears in 2029 and traces back to this incident is the kind of claim these releases are written to cover, which is the real price of the cash and the monitoring, and it is worth reading Section V on the settlement website before deciding.
Doing nothing does not avoid the release. A class member who never files still gives up those claims and is still bound by the Court’s orders — they simply receive nothing in exchange. The only way to keep the right to sue Valley Oaks individually is to opt out by November 9, 2026, which forfeits the cash and the monitoring alike. Given that the $40 requires no proof and no explanation, doing nothing is the one option with no upside.
What Happens Next?
At the December 10, 2026 hearing the Court will decide whether to approve the Settlement, will rule on how Class Counsel should be paid and on whether to award the service award payments, and will consider any timely objections. Nobody is required to attend — the Notice says Class Counsel will answer the Court’s questions and that a timely objection will be considered whether or not the objector appears. The Notice also warns that the date and time may change without further notice, with any change posted on the settlement website.If approval is granted, there may be appeals. The Notice says plainly that it is not known whether appeals will be filed or how long they would take to resolve, and that settlement payments are distributed only if the Court grants final approval and after any appeals are resolved. No payment date has been announced, and a hearing being held is not the same as approval being granted.
Sources and Verification
• Official settlement website — Valley Oaks Data Settlement.com, including its Home, FAQs, Important Documents, Important Dates and claim form login pages• Notice of Proposed Class Action Settlement (PDF)
• In re: Valley Oaks Data Incident Litigation, Case No. 79D01-2403-PL-00032 (Ind. Super. Ct., Tippecanoe Cnty., Superior Court No. 1) — Settlement Agreement and Release, Section V (Releases)
• FTC — IdentityTheft.gov recovery steps
• U.S. Department of Health and Human Services — health information privacy for individuals
Questions
Can I claim the $40 and the reimbursements at the same time?
No. The Notice describes the Alternative Cash Payment as a one-time $40.00 payment claimed instead of any other payments, so it rules out the ordinary out-of-pocket, extraordinary out-of-pocket and lost-time benefits rather than stacking with them. The medical monitoring is described differently: the Notice says all Settlement Class Members are eligible to enroll in Medical Monitoring Services and one or more of the cash payment options, so the two years of coverage is not the thing the $40 trades away. In practice the choice is between taking $40 with nothing to prove and documenting what the incident actually cost.
Do I have to file a claim to get the two years of medical monitoring?
Yes. The Notice says the only way to receive benefits or payments from this Settlement is by submitting a valid and timely Claim Form, and its answer on doing nothing says a class member who does nothing will not receive a benefit. Nothing in the Notice or on the settlement website describes a separate enrollment route for the monitoring, so the claim form is how both the coverage and any cash are requested. Claiming the monitoring requires no documentation at all.
What is CyEx Medical Shield Pro and how is it different from credit monitoring?
It is medical identity monitoring rather than credit monitoring. The Notice says the two-year service comes with $1 million of medical identity theft insurance and watches for healthcare insurance ID exposure, Medical Record Number exposure and unauthorized Health Savings Account spending, with a fraud resolution agent available if something surfaces. Those are the specific risks in a file that held patient account numbers and clinical information: someone else's treatment being billed to your policy and landing in your medical record, which ordinary three-bureau credit monitoring does not watch for.
Is there a settlement fund, and can my payment shrink if too many people file?
The Notice discloses no total settlement amount, no aggregate cap on the cash benefits and no pro rata reduction clause. That is unusual for a data breach settlement, where a fixed fund normally means published payment figures get cut once the claim count is known. The per-person ceilings — $40, $500, $5,000 and $80 — are the only limits stated in the Notice or on the settlement website. The attorneys' fees and the service awards are paid by Valley Oaks separately rather than deducted from class benefits, so nothing described in the Notice reduces a claimant's payment.
Is the lost-time payment capped at $80, or does it share a $500 cap?
The official sources say both, and the difference is worth knowing before filing. The Notice and the settlement website's FAQ page describe lost time as up to four hours at $20.00 per hour for a maximum of $80.00, with no reference to any shared limit. The claim-form landing page on the same website adds a parenthetical that the lost-time payment combined with Ordinary Out-of-Pocket Losses is capped at $500.00 in total. Anyone claiming close to $500 in ordinary losses plus the full four hours should assume the tighter reading may apply and put the question to the Settlement Administrator through the official settlement website before the deadline.
What information was actually exposed in the Valley Oaks incident?
The court-authorized Notice describes it two different ways. Its summary page says the files may have contained name, date of birth, Social Security number, patient account number, medical diagnosis and clinical information. Its answer to what the lawsuit is about instead lists Social Security number, driver's license or state identification number, other government-issued identification number, account number, credit or debit card number with a security code, access code or password permitting access to financial information, biometric data, DNA profile, and a username or email address with a credential permitting access to an online account. Neither list is presented as complete for any individual, and the Notice does not say which categories applied to which class members. Anyone who wants to know what was in their own file should ask the Settlement Administrator through the official settlement website.
What happens if I do nothing at all?
You receive nothing and you still give up the claims the settlement releases. The Notice states that a class member who does nothing will not receive a benefit and will also give up the rights described in its release answer, which means being bound by the outcome without the $40, the reimbursement tiers or the two years of medical monitoring. The only way to keep the right to sue Valley Oaks individually is a written Request for Exclusion carrying a wet ink signature, and that deadline is the same November 9, 2026 as the claim deadline.
