University of Hawaii $3.5M Data Breach Settlement, Check If You Qualify — In re University of Hawai’i Data Breach Litigation, No. 1CCV-26-0000280

There’s $3.5 million waiting to be split among people affected by a 2025 ransomware attack on the University of Hawai’i Cancer Center — if you file a claim by November 2, 2026. The university agreed to pay $3,500,000 to settle claims after hackers accessed Social Security numbers, driver’s license numbers, and research files tied to a decades-old cancer study. You don’t need proof of loss to get paid.

University of Hawai’i Data Breach Settlement — Key Facts

Settlement Amount	$3,500,000.00
Claim Deadline	November 2, 2026
Who Qualifies	All living individuals in the U.S. notified that their Private Information was potentially compromised in the August 2025 UH Cancer Center Data Incident
Estimated Payout	Up to $5,000 with documented losses (Cash Payment A), or an estimated $50 flat payment with no documentation required (Cash Payment B, subject to pro-rata adjustment)
Proof Required (Yes/No)	No — only required for the higher, documented-loss payment
Settlement Status	Preliminarily approved; awaiting the Final Approval Hearing
Court & Case Number	First Judicial Circuit Court for the State of Hawai’i — Civil No. 1CCV-26-0000280
Law Alleged	UNVERIFIED — specific causes of action aren’t detailed in the public Notice or settlement website
Administrator	Epiq
Official Claim Site	UHDataSettlement.com
Last Updated	September 23, 2026

Who Is the University of Hawai’i and Why Is It Being Sued for This Data Breach?

The University of Hawai’i is the state’s public university system, and its Cancer Center in Honolulu is Hawai’i’s only cancer center designated by the National Cancer Institute — exactly the kind of research institution that sits on decades of sensitive participant data. That’s what made it a target: on August 31, 2025, a ransomware group broke into servers supporting the Cancer Center’s Epidemiology Division and stole files tied to a cancer study first launched in 1993. The university has confirmed it paid the attackers for a decryption tool and a promise that the stolen data would be destroyed.

What Did the University of Hawai’i Do to Affected Individuals Between August 2025 and Today?

On or around August 31, 2025, an unauthorized third party — later identified as a ransomware group — broke into servers supporting research operations at the UH Cancer Center’s Epidemiology Division. The attackers encrypted large amounts of data and provided proof they’d also copied a portion of it before UH could stop them.

Most of what was taken traces back to the Multiethnic Cohort Study, a cancer research project that recruited more than 215,000 participants between 1993 and 1996. Some exposed files were even older — legacy records from 1998 to 2000 that used Social Security numbers as identifiers, pulled from Hawai’i driver’s license and voter registration data of that era. In total, the university notified roughly 1.2 million people that their names, Social Security numbers, driver’s license numbers, or research-related information may have been exposed.

UH says there’s no evidence, so far, that any stolen data has been published or misused, and that the breach never touched clinical records, patient care systems, or student records.

The company paying off ransomware attackers doesn’t undo the exposure — it just means records that sat quietly for 30 years are now the reason you’re reading this.

Who Qualifies for the University of Hawai’i Data Breach Settlement?

Here’s exactly how to know if this case includes you.

You qualify if:

• You received a notification letter or email from the University of Hawai’i saying your Private Information was potentially compromised in the August 2025 Data Incident
• You were one of the 87,493 Multiethnic Cohort Study participants recruited between 1993 and 1996
• You’re one of the roughly 1.2 million additional individuals UH identified and notified based on contact information found in the breached files

You do not qualify if:

• You never received a notice from UH about this specific incident
• Your information was part of a different UH data incident, such as the 2023 breach at Hawai’i Community College

University of Hawai’i Data Breach — Affected Individuals Outside Hawai’i: Are You Still Covered?

Yes. The Settlement Class isn’t limited to Hawai’i residents — it covers all living individuals in the United States who received a notice, regardless of where they live now. Many original study participants have since moved off the islands, and this settlement follows them.

That’s 40 days from today to file, for a claim that takes a few minutes online — there’s no real reason to let it lapse.

Not sure if you qualify for the University of Hawai’i data breach settlement? A free consultation with a data privacy attorney can help before the November 2 deadline.

How Much Can University of Hawai’i Data Breach Settlement Class Members Get? Up to $5,000 Per Person

The settlement created a $3,500,000 fund covering every valid claim, administration costs, and any attorneys’ fees the court approves. What you get depends on which payment you choose.

University of Hawai’i Payout With Proof — Up to $5,000

If you have documentation — receipts, bank or phone records, correspondence — tying actual financial losses to this breach, you can claim reimbursement up to $5,000. Personal statements alone don’t count as documentation, though they can support other evidence you submit.

University of Hawai’i Payout Without Proof — Estimated $50

If you don’t have documented losses, you can still claim a flat cash payment currently estimated at $50. That figure isn’t locked in.

What Pro-Rata Means for Your University of Hawai’i Check

More people filing for the $50 option means each payment could shrink; fewer filers means it could grow, since the leftover fund gets divided evenly among claimants. All Class Members, regardless of which cash option they pick, can also claim one free year of CyEx Medical Data Monitoring.

Payments go out after the court grants final approval and any appeals are resolved — there’s no fixed date yet. Payments over $600 may appear on a 1099. Check with a tax professional.

That money is yours if you file. If you don’t, it goes back into the fund and pays for something else.

How to File Your University of Hawai’i Data Breach Settlement Claim — Step by Step

1. Go to UHDataSettlement.com and start your claim, or use the Submit a Claim login page directly.
2. Enter your name, contact information, and the details from your notification letter if you have them.
3. Choose Cash Payment A (documented losses, up to $5,000) or Cash Payment B (flat estimated $50, no proof needed).
4. If choosing Cash Payment A, upload your documentation — receipts, records, or correspondence tied to the breach.
5. Add a claim for one year of CyEx Medical Data Monitoring if you want it — available regardless of which cash option you pick.
6. Submit and save your confirmation. Watch your email or mail for updates from Epiq, the Settlement Administrator.

Takes about 10 minutes. Mark your calendar for November 2, 2026 — that’s the filing deadline, and it holds for both cash options and the monitoring claim.

Should University of Hawai’i Class Members Opt Out or Object Before October 19, 2026?

What Opting Out of the University of Hawai’i Settlement Actually Means

Opting out means no payment and no medical data monitoring, but you keep the right to sue the university on your own over this breach. Most people shouldn’t opt out without talking to a lawyer first. The opt-out deadline is October 19, 2026, and the request must be mailed — not emailed or called in.

How to Object to the University of Hawai’i Settlement

Objecting keeps you in the class while telling the court you disagree with part of the deal — the payout structure or the requested attorneys’ fees, for example. Objections must be mailed to the Clerk of the First Judicial Circuit Court of Hawai’i at Ka’ahumanu Hale, 777 Punchbowl Street, Honolulu, HI 96813-5093, along with Class Counsel and Defendant’s Counsel, following the exact format the Notice requires, postmarked by October 19, 2026.

Talk to a class action lawsuit attorney before October 19 if you’re considering either option.

University of Hawai’i Data Breach Settlement — Key Dates, 2026

Milestone	Date
Data Incident Occurred	August 31, 2025
Settlement Preliminarily Approved	UNVERIFIED — exact date not stated in the Notice or settlement homepage
Claims Period Opens	UNVERIFIED — not specified
Claim Filing Deadline	November 2, 2026
Opt-Out Deadline	October 19, 2026
Objection Deadline	October 19, 2026
Final Approval Hearing	November 4, 2026, 9:00 a.m.
Expected Payment Date	UNVERIFIED — begins after final approval and any appeals resolve; no fixed date given

University of Hawai’i Data Breach — Frequently Asked Questions, No. 1CCV-26-0000280

Do I need a lawyer to file a University of Hawai’i data breach settlement claim?

 No. Filing online at UHDataSettlement.com takes a few minutes and doesn’t require a lawyer. If you’re weighing whether to opt out and pursue your own claim instead, that’s when talking to an attorney makes sense.

Is the University of Hawai’i data breach settlement legitimate?

 Yes. It’s a $3,500,000 settlement reached in In re University of Hawai’i Data Breach Litigation, Civil No. 1CCV-26-0000280, overseen by Judge Steven Nichols in Hawai’i’s First Judicial Circuit Court, and administered by Epiq — not a third-party scam site.

When will University of Hawai’i settlement payments be sent?

 Not until after the Final Approval Hearing on November 4, 2026, and only once any appeals of that approval are resolved. No specific payment date has been set.

What if I missed the University of Hawai’i claim deadline?

 Claims must be submitted online or postmarked by November 2, 2026. Missing it generally means forfeiting payment, though you’d still be bound by the settlement’s terms unless you’d separately opted out earlier.

Will my University of Hawai’i settlement payment go on a 1099?

 Possibly, if your payment exceeds $600. Check with a tax professional about how to report any settlement payment you receive.

How do I know if I’m part of the Multiethnic Cohort Study group specifically?

 If you took part in the Multiethnic Cohort Study between 1993 and 1996, or received a letter referencing that study, you’re among the roughly 87,493 participants UH identified as affected and should have received a notice.

Does the University of Hawai’i settlement cover identity theft, not just the data exposure itself? 

Yes — Cash Payment A specifically covers documented losses reasonably tied to fraud or identity theft connected to this breach, up to $5,000, separate from the flat $50 option.

Sources Used in This University of Hawai’i Article

• Official Settlement Website — UHDataSettlement.com, administered by Epiq: https://uhdatasettlement.com/
• Long Form Notice of Proposed Class Action Settlement, In re University of Hawai’i Data Breach Litigation, Civil No. 1CCV-26-0000280: https://uhdatasettlement.com/Content/Documents/Long%20Form%20Notice.pdf
• Settlement Documents index (Settlement Agreement, Preliminary Approval Order, Motion for Preliminary Approval): https://uhdatasettlement.com/Home/Documents
• University of Hawai’i Cancer Center’s own incident and FAQ page: https://hawaii.edu/cancercenter/incident/
• “1.2 Million Affected by University of Hawaii Cancer Center Data Breach,” SecurityWeek: https://www.securityweek.com/1-2-million-affected-by-university-of-hawaii-cancer-center-data-breach/
• “University of Hawai’i Cancer Center: 1.15 Million Individuals Affected by 2025 Ransomware Attack,” HIPAA Journal: https://www.hipaajournal.com/university-of-hawaii-cancer-center-ransomware-data-breach/

Researched and written by Israr Ahmad, legal content researcher and founder of AllAboutLawyer.com. All facts verified against the official Settlement Website, the court-approved Long Form Notice, and University of Hawai’i’s own incident disclosure as of September 23, 2026. Last Updated: September 23, 2026.

Disclaimer: This article is for informational purposes only and does not constitute legal advice. Laws vary by state and individual circumstances differ. For advice about your specific situation, consult a qualified attorney.