Highlands Oncology Data Breach Settlement, Check If You Qualify — In re Highlands Oncology Group Data Breach Litigation, No. 72CV-25-3420

There’s real money on the table here — up to $4,250 — if you were one of the roughly 113,575 people caught up in Highlands Oncology’s June 2025 data breach. Highlands Oncology Group agreed to pay for documented losses and offer three years of medical data monitoring to settle the claims against it. You have until October 22, 2026, to file.

Highlands Oncology Data Breach Settlement — Key Facts

Settlement Amount	UNVERIFIED — no aggregate settlement fund total is disclosed on the settlement website; individual payments are capped per claim type below
Claim Deadline	October 22, 2026
Who Qualifies	All U.S. residents whose private information was compromised in the June 2025 Data Incident
Estimated Payout	Up to $4,250.00 with documented losses, or a flat $50.00 with no proof required
Proof Required (Yes/No)	Yes for the $4,250 documented-loss payment; No for the $50 flat payment
Settlement Status	Preliminary approval granted June 16, 2026; final approval pending
Court & Case Number	Circuit Court for Washington County, Arkansas — No. 72CV-25-3420
Law Alleged	Negligence, negligence per se, breach of implied contract, unjust enrichment, and invasion of privacy (intrusion upon seclusion)
Administrator	Simpluris
Official Claim Site	highlandsoncologysettlement.com/form/claim
Last Updated	September 12, 2026

Who Is Highlands Oncology and Why Are They Being Sued for the Data Breach?

Highlands Oncology Group is a physician-owned cancer care practice with locations across Northwest Arkansas, treating patients through chemotherapy, radiation, and diagnostic services — which means it holds exactly the kind of records a ransomware crew wants: Social Security numbers, insurance policy details, and medical treatment history in one place. That combination made it a target, and it’s why the lawsuit alleges Highlands didn’t lock that data down well enough.

What Did Highlands Oncology Do to Patients Between January and June 2025?

An unauthorized party got into Highlands Oncology’s network as early as January 21, 2025, and stayed there — off and on — until June 2, 2025, when the intrusion was finally detected. The Medusa ransomware group later claimed responsibility, listing Highlands on its extortion site with a $700,000 demand and a deadline to pay. It’s still not clear whether that ransom was paid.

During those months, the files accessed reportedly included names, dates of birth, Social Security numbers, driver’s license and passport numbers, credit and debit card numbers, financial account numbers, medical treatment information, medical record numbers, and health insurance policy information. Highlands started mailing notification letters on August 1, 2025. Thirteen separate lawsuits followed within days of each other, all making similar claims — negligence, breach of implied contract, unjust enrichment — and the court consolidated them into one case.

Here’s something worth knowing before you assume this was a one-time fluke: Highlands reported a separate ransomware incident to federal regulators back in December 2023, affecting 55,297 patients. This is the second time in about two years that patient records here ended up in the wrong hands.

Who Qualifies for the Highlands Oncology Data Breach Settlement?

Here’s exactly how to know if this case includes you.

• Anyone who received a breach notification letter from Highlands Oncology in mid-2025
• Current or former patients whose Social Security number, financial account, or medical record information was stored in Highlands’ systems as of June 2025
• Residents of any U.S. state — this isn’t limited to Arkansas
• People who paid out of pocket for credit monitoring, ID replacement, or fraud recovery because of this specific breach

Who’s excluded: directors and officers of Highlands Oncology, government entities, and the presiding judge’s immediate family and staff. If you’re unsure whether you’re a class member, the settlement administrator will check for free.

Highlands Oncology Patients Outside Arkansas — Are You Still Covered?

Yes. The class is defined nationwide — every U.S. resident whose private information was compromised in the June 2025 incident qualifies, regardless of what state you live in now or lived in when you were treated.

Not sure if you qualify for the Highlands Oncology data breach settlement? A free consultation with a data privacy attorney can help before the October 22 deadline, especially if your losses were significant enough that you’re weighing whether to opt out and pursue your own claim instead.

How Much Can Highlands Oncology Data Breach Settlement Class Members Get? Up to $4,250 Per Person

You’ve got two options, and you can only pick one.

Highlands Oncology Payout With Proof — Up to $4,250.00

If you can show actual, documented losses tied to the breach — fraud charges, credit monitoring fees, ID replacement costs, postage to contact your bank — between June 2, 2025, and October 22, 2026, you can claim up to $4,250. You’ll need receipts, bank statements, or similar proof; notes you write yourself can support that proof but can’t stand in for it alone.

Highlands Oncology Payout Without Proof — $50.00 Flat

Don’t have receipts? You can still claim a flat $50, no questions asked, no paperwork beyond the claim form itself.

What Everyone Gets, Either Way

Regardless of which cash option you pick, every class member can enroll in three years of CyEx Medical Shield Complete, which includes $1 million in medical identity theft insurance and monitoring for health insurance ID misuse, medical record number exposure, and unauthorized HSA spending.

Payments over $600 may appear on a 1099. Check with a tax professional. And keep this in mind: there’s no confirmed total settlement fund published, so if enough people file for the $4,250 tier, individual amounts could shift depending on how the claims process plays out. That’s the tradeoff for a strong per-person cap.

How to File Your Highlands Oncology Data Breach Settlement Claim — Step by Step

1. Go to highlandsoncologysettlement.com/form/claim
2. Enter your name, contact information, and the details requested from your notice letter
3. Choose your cash payment option — $4,250 with proof, or $50 flat
4. Upload proof of your losses if you’re filing for the $4,250 tier — bank statements, receipts, or credit monitoring invoices
5. Elect to enroll in the free medical data monitoring, then submit and save your confirmation number
6. Watch your email — the administrator will contact you if anything’s missing

Takes about 10 minutes. ⚠️ 40 days left as of this writing — file now at highlandsoncologysettlement.com/form/claim.

Should Highlands Oncology Class Members Opt Out or Object Before October 7, 2026?

What Opting Out of the Highlands Oncology Settlement Actually Means

Opting out means you get no payment and no monitoring from this settlement — but you keep the right to sue Highlands Oncology on your own. Most people shouldn’t opt out without talking to a lawyer first. The exact opt-out deadline is October 7, 2026.

How to Object to the Highlands Oncology Settlement

Staying in the class but objecting means telling the Circuit Court for Washington County, Arkansas, in writing, exactly why you think the settlement falls short. Objections must be filed with the Clerk of Court at 280 N College Ave, Fayetteville, AR 72701, and copies sent to Class Counsel and defense counsel, by October 7, 2026.

Talk to a class action lawsuit attorney before October 7 if you’re considering either option.

Highlands Oncology Data Breach Settlement — Key Dates, 2026

Milestone	Date
Preliminary Approval Granted	June 16, 2026
Notification Mailing	July 16, 2026
Opt-Out Deadline	October 7, 2026
Objection Deadline	October 7, 2026
Claim Filing Deadline	October 22, 2026
Final Approval Hearing	November 6, 2026, 9:00 a.m. CT
Expected Payment Date	UNVERIFIED — payments go out only after final approval and any appeals are resolved; no date set yet

Highlands Oncology Data Breach — Frequently Asked Questions, No. 72CV-25-3420

Do I need a lawyer to file a Highlands Oncology data breach settlement claim?

 No. The claim form at highlandsoncologysettlement.com is designed to be filed on your own in a few minutes. A lawyer only makes sense if you’re weighing an opt-out or have losses well beyond the $4,250 cap.

Is the Highlands Oncology data breach settlement legitimate? 

Yes. It’s court-approved and administered by Simpluris under supervision of the Circuit Court for Washington County, Arkansas, Case No. 72CV-25-3420. Be cautious of anyone contacting you asking for payment to “process” your claim — the real process is free.

When will Highlands Oncology settlement payments be sent? 

Not before the Final Approval Hearing on November 6, 2026, and only after any appeals of that approval are resolved. There’s currently no confirmed payment date.

What if I missed the Highlands Oncology claim deadline? 

Claims postmarked or submitted online after October 22, 2026, are generally rejected. Contact the settlement administrator at (833) 421-7336 immediately if you believe you have an exception.

Will my Highlands Oncology settlement payment go on a 1099? 

Payments over $600 may be reported on a 1099. Check with a tax professional about how to handle it.

How much will I get from the Highlands Oncology settlement?

 Up to $4,250 if you document your losses, or a flat $50 if you don’t. Everyone also qualifies for three years of medical data monitoring with $1 million in identity theft insurance, separate from either cash option.

I was only affected by Highlands Oncology’s 2023 breach — am I part of this settlement? 

No. This settlement, No. 72CV-25-3420, covers only the June 2025 Data Incident. The earlier December 2023 incident, which affected 55,297 patients, was reported and resolved separately.

What is the CyEx Medical Shield Complete benefit in the Highlands Oncology settlement?

 It’s three years of free medical identity monitoring that comes with every claim, tracking things like misuse of your health insurance ID, your medical record number, and unauthorized HSA spending, with $1 million in identity theft insurance behind it.

Sources Used in This Highlands Oncology Data Breach Article

• Official Settlement Website — In re Highlands Oncology Group Data Breach Litigation, accessed September 12, 2026: https://www.highlandsoncologysettlement.com/
• Official Settlement FAQ — Simpluris, accessed September 12, 2026: https://www.highlandsoncologysettlement.com/faq/
• The HIPAA Journal — “Highland Oncology Group Settles Litigation Stemming From 2025 Ransomware Attack,” September 2026: https://www.hipaajournal.com/highland-oncology-group-data-breach-settlement/
• DataBreaches.net — reporting on the December 2023 Highlands Oncology ransomware incident affecting 55,297 individuals, sourced from HHS closing statement: https://databreaches.net/?p=123199

Researched and written by Israr Ahmad, legal content researcher and founder of AllAboutLawyer.com. All facts verified against the official settlement website and FAQ, and against The HIPAA Journal’s reporting on the underlying breach, as of September 12, 2026. Last Updated: September 12, 2026.

This article is for informational purposes only and does not constitute legal advice. Laws vary by state and individual circumstances differ. For advice about your specific situation, consult a qualified attorney.