Highlands Oncology Will Pay Every Valid Claim in Full — $50 With No Proof, Up to $4,250 With Receipts, Three Years of Medical-Identity Monitoring — for a Ransomware Intrusion That Sat Undetected in a Cancer Practice for 132 Days.

The settlement agreement's own procedural history is the cleanest account of the incident. “On or around June 2, 2025, Highlands Oncology discovered unauthorized access by third-party actors that resulted in an unauthorized disclosure, exfiltration, and theft of current and former patients' highly personal information.” Then the sentence that sets the scale: “Highlands Oncology first detected unauthorized access on June 2, 2025, but internal investigation revealed that the cybercriminals had accessed the network as early as January 21, 2025.” That is 132 days of undetected access to a practice that, per the agreement, “provides cancer care as a multidisciplinary practice” across “six locations.” HIPAA Journal, reporting on August 5, 2025, attributed the attack to the Medusa ransomware group, a $700,000 ransom demand, and noted the group's listing later disappeared from its leak site; we cite that as HIPAA Journal's account, not the court's.

The data categories in the class notice are the reason this settlement includes medical-identity monitoring rather than ordinary credit monitoring: “names; dates of birth; Social Security numbers; driver's license/state identification numbers; passport numbers; credit/debit card numbers; financial account numbers; medical treatment information; medical record numbers; patient account numbers; and/or health insurance policy information.” Notification letters went out on or about August 1, 2025; the first lawsuit followed four days later. By September 4, 2025 the court had consolidated thirteen cases and appointed Mariya Weekes of Milberg and J. Gerard Stranch IV of Stranch, Jennings & Garvey as interim lead counsel; a consolidated complaint pleading negligence, negligence per se, breach of implied contract, unjust enrichment and intrusion upon seclusion was filed October 6; Highlands moved to dismiss on November 5; and the parties spent January 16, 2026 in a full-day mediation with John DeGroote that produced the deal. Preliminary approval was signed electronically by Judge William D. Martin on June 16, 2026.

Section IV of the agreement is short: “Highlands Oncology has agreed to pay, or cause to be paid, for the following: (a) all Settlement Administration Costs; (b) Cash Payments to and Medical Data Monitoring for Settlement Class Members; and (c) any Court-awarded attorneys' fees, costs, and Service Awards.” There is no settlement fund, no aggregate cap, and no pro rata clause anywhere in the 83 pages — we searched for all three. Every valid claim is paid at face value. The mechanics are in paragraphs 92 and 93: the administrator invoices Highlands for all valid claims within 30 days of the Effective Date, Highlands pays the invoice within 30 days, and “no later than 60 days after the Effective date” the administrator distributes the cash and emails the monitoring activation codes.

The choice is either/or. Cash Payment A — Documented Losses: “up to $4,250.00” for out-of-pocket losses “between June 2, 2025, and October 22, 2026” — identity-theft losses, credit report and freeze fees, ID replacement, postage — on proof such as bank statements or receipts; your own notes can support the proof but “alone are not enough,” and anything already reimbursed by a third party is out. Cash Payment B — Alternate Cash: “a one-time cash payment of $50.00,” and “You do not have to provide any proof or explanation to claim this payment.” HIPAA Journal described the $50 as “a one-time pro rata cash payment, estimated to be around $50”; the agreement does not — paragraph 17 defines it as “the $50.00 cash compensation,” fixed, and with no fund there is nothing to prorate. Medical Data Monitoring is available to every class member with or without a cash election: three years of CyEx Medical Shield Complete, with “$1 million of medical identity theft insurance” and monitoring of health-insurance ID exposure, medical record number exposure and unauthorized HSA spending. Like every claims-made settlement, you get nothing without a form — “If a Settlement Class Member does not submit a Valid Claim, the Settlement Class Member will release his or her claims without receiving a Settlement Class Member Benefit.”

Neither the notice nor the agreement states a class size; the preliminary approval order says only that “there are thousands of Class Members.” The public numbers come from breach regulators: HIPAA Journal reports 113,575 individuals per the Maine Attorney General filing and 111,766 on the HHS Office for Civil Rights portal — the kind of small gap that usually reflects a later, corrected count.

The agreement contains one number that does not fit either. Paragraph 78, the termination clause, lets Highlands walk away “If more than 1,200 (approximately 2%) Settlement Class Members have timely and validly submitted Requests for Exclusion.” If 1,200 is approximately 2 percent, the class is approximately 60,000 — a little over half the regulator count. We cannot tell from the documents whether that means the settlement class is smaller than the notified population (some breach notices go to people who are not U.S. residents, or to duplicates), or whether “approximately 2%” is simply loose drafting around a round threshold. We flag it because it changes one thing a reader might otherwise assume: the 113,575 figure is not the number of people who will be paid, and no per-person calculation from it is meaningful in a settlement with no fund.

Three dates. October 7, 2026 is the deadline both to opt out (a mailed Request for Exclusion, postmarked, with your name, contact details, signature and the words “Request for Exclusion”) and to object (filed with the Clerk of Court in Fayetteville and mailed to the administrator, class counsel and defense counsel). The objection rules are strict: the notice requires, among eight items, a list of every class action objection you or your lawyer have filed in the past five years with the orders ruling on them, and your personal signature — “if you have hired your own lawyer, their signature is not sufficient.” October 22, 2026 is the claims deadline — online at HighlandsOncologySettlement.com, or postmarked by mail to the administrator's Santa Ana P.O. box; the settlement site also offers a phone line, (833) 421-7336, for paper forms. November 6, 2026 at 9:00 a.m. Central is the final approval hearing at the Washington County Circuit Court, 280 N College Ave, Fayetteville; nobody has to attend, and a timely written objection is considered whether or not you appear.

What class counsel will ask for is stated in the notice: “$400,000.00 as reasonable attorneys' fees and reimbursement of litigation costs,” and service awards of $1,500 for each of the eleven class representatives — Jim Davis, Nathan Stewart, Michael Plunkentt, Michael Crawford, Keely Boman, Dasha Nichols, Renetta Frisque, Michelle Nalley, Stacye Peebles, Julie Rae Gonzalez and Matthew Prunty III. Both are “paid by Highlands Oncology” separately from the claims, and the agreement says the settlement “is not contingent on approval of the request for attorneys' fees.” Payments, per the notice, go out “if the Court grants final approval, and after any appeals are resolved” — realistically 2027 for the $50, and the same for the documented-loss claims once the administrator has cured any deficiencies. The one thing to do before October 22 is the thing most people skip on a $50 claim: request the monitoring. In a breach where medical record numbers and insurance IDs were taken, the $1 million medical-identity policy is worth more than the check.