Highlands Oncology Data Breach Class Action Settlement

Data Breach · Claims Open

Current Status

Claims are open. A claim form must be submitted online or postmarked no later than October 22, 2026. There is an earlier date that is easy to miss: October 7, 2026 is the deadline both to exclude yourself and to object. The Court granted preliminary approval and has scheduled a final approval hearing for November 6, 2026 at 9:00 a.m. Central Time in Fayetteville, Arkansas — after claims close. No final approval order has been entered and no payment date had been announced as of August 24, 2026.

What Changed Recently?

The Circuit Court for Washington County, Arkansas authorized notice to the class, which opened the claim window and put the November 6, 2026 final approval hearing on the calendar. The case is In re Highlands Oncology Group Data Breach Litigation, Case No. 72CV-25-3420.

The lawsuit alleges that during a June 2025 targeted cyberattack on Highlands Oncology's computer systems, certain files containing private information were accessed. According to the court-approved Notice, those files may have contained names, dates of birth, Social Security numbers, driver's license and state identification numbers, passport numbers, credit and debit card numbers, financial account numbers, medical treatment information, medical record numbers, patient account numbers, and health insurance policy information.

That combination is what makes this settlement's monitoring benefit unusual. Most data breach settlements offer credit monitoring, which watches for new accounts opened in your name. Here the exposure includes medical record numbers and health insurance policy information, so the settlement offers medical data monitoring instead — a different product aimed at a different kind of fraud.

Highlands Oncology denies that it did anything wrong, and the Court has not decided who is right. The parties agreed to settle to avoid the costs, risks, disruptions and uncertainties of continuing the case. Healthcare providers have produced a steady run of these settlements — the Tift Regional Health System settlement and the MCNA Dental settlement both turned on the same kind of patient-record exposure.

Who Qualifies?

The Court defined the Class as all individuals residing in the United States whose Private Information was compromised in the Data Breach on or around June 2025. This is a nationwide class rather than an Arkansas-only one — what matters is that your information was in the affected files, not where you live.

The Notice states that Highlands Oncology's records indicate who the class members are, and that a class member may also have received an earlier notice directly from Highlands Oncology at the time of the incident.

The class excludes only three groups, which is a narrower carve-out than most breach settlements:

• All persons who are directors and officers of Highlands Oncology;
• Governmental entities; and
• The Judge assigned to the case, that Judge's immediate family, and Court staff.

How Much Can You Get?

The benefits come in two parts, and the relationship between them is the single most misread thing on pages like this: the monitoring and the cash are additive. The Notice states that all Settlement Class Members may claim Medical Data Monitoring and one of the two Cash Payment options. The choice is only between the two cash tiers.

• Medical Data Monitoring. Three years of CyEx Medical Shield Complete, which carries $1 million of medical identity theft insurance and monitors for healthcare insurance ID exposure, Medical Record Number exposure, and unauthorized Health Savings Account spending. If something suspicious surfaces, the service provides access to a fraud resolution agent.