Highlands Oncology Data Breach Settlement: $50 Cash or Up to $4,250, File by October 22, 2026

Highlands Oncology Group is a physician-owned cancer care practice based in Northwest Arkansas that also serves patients in Southwest Missouri and Southeast Oklahoma. According to HIPAA Journal, the practice identified a ransomware attack on or around June 2, 2025, and its investigation found the attackers had first gained access to its network as early as January 21, 2025. Affected people were notified on August 1, 2025.

The official settlement website says files accessed in the attack may have contained names, dates of birth, Social Security numbers, driver's license or state ID numbers, passport numbers, credit and debit card numbers, financial account numbers, medical treatment information, medical record numbers, patient account numbers, and health insurance policy information. That mix of financial and medical data is why this data breach carries a real risk of both financial and medical identity fraud.

HIPAA Journal reports that thirteen separate class action lawsuits were filed after the breach and later consolidated into one case in Washington County, Arkansas. The consolidated complaint claimed negligence, negligence per se, breach of implied contract, unjust enrichment, and invasion of privacy. Highlands Oncology moved to dismiss, then settled after mediation. Highlands Oncology denies that it did anything wrong, and the court has not decided who is right. For more on how these cases usually play out, see our data breach lawsuit guide.

The court defined the class as all individuals residing in the United States whose private information was compromised in the Highlands Oncology data breach on or around June 2025. HIPAA Journal puts the number of affected people at 113,575.

• If you received a breach notice letter from Highlands Oncology in or after August 2025, you are very likely in the class.
• Past patients count, not just current ones. What matters is whether your information was in the compromised files.
• Excluded: Highlands Oncology directors and officers, government entities, and the judge assigned to the case, the judge's immediate family, and court staff.

If you were treated at Highlands but never got a letter, or you are not sure the letter you got was about this incident, contact the settlement administrator, Simpluris, at (833) 421-7336 or info@HighlandsOncologySettlement.com. The line is toll free and open 24/7. You do not need to prove your identity was stolen to be a class member, but you do need records if you want more than the $50 option.

Every class member can claim medical data monitoring plus one of two cash options. You cannot take both cash options.

Documented losses must have happened between June 2, 2025 and October 22, 2026 to count toward the $4,250 cap. Covered costs include losses from identity theft or fraud, fees for credit reports, credit monitoring, or freezing and unfreezing your credit, the cost of replacing IDs, and postage to contact banks. Your own notes can support a claim, but the website says notes alone are not enough; you need bank statements, receipts, or similar records, and you cannot claim costs a third party already reimbursed.

The monitoring service includes $1 million of medical identity theft insurance and watches for exposure of your health insurance ID and medical record number and for unauthorized Health Savings Account spending.

Unlike many breach settlements, this deal has no fixed common fund that gets divided pro rata. The official website describes the $50 as a flat one-time payment. Class counsel will ask for $400,000 in fees and costs and $1,500 service awards for each class representative, and Highlands pays those separately. For context on typical outcomes, see how much a data breach settlement is worth.

1. Go to HighlandsOncologySettlement.com and choose Submit a Claim. Filing online is the fastest route.
2. Pick Cash A or Cash B. If your documented losses are under $50, Cash B pays more and needs no paperwork.
3. For Cash A, upload records that show the expense and tie it to the breach, such as a bank statement showing a fraudulent charge or a receipt for a credit freeze.
4. Elect the three years of medical data monitoring on the same claim form.
5. Submit by October 22, 2026. A mailed form must be signed and postmarked by that date and sent to Highlands Oncology Data Incident Settlement, c/o Settlement Administrator, P.O. Box 25226, Santa Ana, CA 92799.

Each person whose data was exposed files their own claim. Keep a copy of your confirmation. Payments go out only after final approval and any appeals are resolved, so expect to wait months after the November 2026 hearing. Watch for scams: the real site never asks for a fee. Our guide on how to file a settlement claim covers the basics.

The opt-out and objection deadline, October 7, 2026, comes 15 days before the claim deadline. The hearing is set for the Washington County courthouse at 280 N College Ave, Fayetteville, Arkansas, and the date can change without further notice, so check the official site.

If you do nothing, you get no money and still give up your right to sue Highlands Oncology over the breach. To keep that right, you must opt out by mailing a signed Request for Exclusion to the administrator, postmarked by October 7, 2026. It must include the case name and number, your full name, mailing address, phone number, email, and a clear statement that you want to be excluded. You can only exclude yourself.

Opting out usually makes sense only if you suffered serious, documented harm well above $4,250, such as major identity theft losses. In that case, talking with a lawyer first is wise, and a free case review can connect you with independent attorneys who handle data breach claims. Objecting is different: you stay in the class and tell the court what you dislike. See how to opt out or object.

If you miss October 22, 2026, the settlement does not promise late claims will be accepted. Contact the administrator right away and ask. Either way, protect yourself: freeze your credit and review your medical benefit statements, following our checklist on what to do after a data breach notice.

Other breach settlements with similar lost-time and documented-loss tiers include the Globe Life and American Income Life settlement and the Labcorp data breach settlement. The full list of settlements still accepting claims is on our open settlements page. To get paid here, file on the official settlement website linked above before October 22, 2026. We do not file claims for anyone.