Hillcrest’s Data Breach Settlement Has a $50 No-Proof Payment — but Only the “Group 1” Subclass Can Take It, and the Judge Already Held the Hearing Two Days Before Claims Close

Most write-ups of this settlement lead with “$50 cash, no proof required.” The court-authorised notice is narrower than that, and the narrowing is the whole story.

The notice defines the class as “All living individuals in the United States whose Private Information was implicated in the Data Incident,” then splits it in two on one fact:

• Group 1 Settlement Subclass Members — “Settlement Class Members who did have their Social Security number(s) among the Private Information potentially impacted in the Data Incident.”
• Group 2 Settlement Subclass Members — “Settlement Class Members who did not have their Social Security number(s) among the Private Information potentially impacted.”

The notice adds: “A Settlement Class Member is either a Group 1 Settlement Subclass Member or Group 2 Settlement Subclass Member; not both.”

Then, on benefits: “All Settlement Class Members may claim Credit Monitoring Services and reimbursement for Documented Losses. Group 1 Settlement Subclass Members also have the option of a $50.00 Alternative Cash Payment.”

So if your Social Security number was not in the exposed file, there is no no-proof cash for you in this settlement. There is two years of credit monitoring, and there is a reimbursement path that requires receipts. That is a materially different offer, and it is worth knowing before you sit down to fill in a claim form expecting $50.

Credit monitoring — everyone. Two years of CyEx Identity Defense Complete, which the notice describes as carrying “$1 million in identity theft insurance” and including “real time monitoring of your credit file,” “dark web scanning” and “comprehensive public records monitoring,” with access to a fraud resolution agent.

Documented losses — everyone, up to $2,500. The notice: “All Settlement Class Members may file a claim for reimbursement of incurred actual, documented out-of-pocket losses due to the Data Incident, up to $2,500.00.” Eligible costs listed include losses from identity theft or fraud, fees for credit reports or credit freezes and unfreezes, the cost of replacing IDs, and postage to contact banks by mail. Proof is required — “bank statements or receipts” — and the notice is explicit that self-written notes “alone are not enough to make a valid claim.”

$50 alternative cash — Group 1 only, as above.

There is a scheduling quirk in the loss window worth pointing out, because it is unusual enough to be worth reading twice: the reimbursable losses must have occurred “between June 27, 2024, and August 26, 2026” — and August 26, 2026 is also the day the claim window closes. A loss incurred on the final eligible day is, in practice, a loss you cannot document, file and submit in time.

The sequence here is the opposite of what most people assume. From the notice: “The Court will hold a final approval hearing on August 24, 2026.” That was the day before yesterday, at 10:00 a.m. Eastern, in the Superior Court of Durham County, North Carolina.

The claim deadline is August 26, 2026 — tomorrow. Opt-out and objection deadlines both passed on July 27, 2026.

As of our check today, no ruling from the August 24 hearing has been posted to the settlement website, and the site still presents the hearing prospectively. That is not unusual — orders often take days or weeks to post — but it does mean anyone filing tomorrow is filing into a settlement whose approval status is not publicly confirmed. The notice is candid about what comes after: “If the Court approves the Settlement, there may be appeals. We do not know if appeals will be filed, or how long it will take to resolve them… Settlement payments will be distributed if the Court grants final approval, and after any appeals are resolved.”

Filing tomorrow costs nothing and preserves the claim. Not filing forfeits it while still releasing the legal claims — the notice’s “do nothing” row is blunt: “you will not receive benefits or payments from this Settlement and you will give up the right to sue.”

We read all nine pages of the long-form notice looking for a headline number. There isn’t one. No “$X million settlement fund” appears anywhere in it.

What the notice does disclose is how the lawyers get paid, and it is billed separately from the class benefits: “Class Counsel will ask the court to approve $325,000.00 as reasonable attorneys’ fees and costs of litigation. This amount will be paid by Hillcrest. Class Counsel will also ask for Service Award payments of $2,500.00 for each of the Class Representatives. Service Award payments will also be paid by Hillcrest.”

That structure — fees on top, paid by the defendant, with class benefits paid as claims come in rather than out of a fixed pot — means the total cost of this settlement is not knowable in advance and is not being represented to class members as a number. It is worth stating plainly because a reader who has seen “$X million settlement” headlines elsewhere may reasonably assume a fund exists here. Based on the court-authorised notice, it does not.

The underlying incident: a cyberattack on Hillcrest’s systems in June 2024, with the notice listing potentially affected data as “names; addresses; financial account information; dates of birth; driver’s license numbers; Social Security Numbers; and other government issued ID numbers; as well as medical treatment; health insurance; and provider information.” Hillcrest “denies that it did anything wrong, and the Court has not decided who is right.”

On scale: the figure reported for this breach is 106,194 individuals, tied to a filing with the U.S. Department of Health and Human Services on March 4, 2025, with individual notification letters beginning March 3, 2025. That count does not appear in the settlement notice itself and we could not read it directly from the HHS breach portal today, so we report it as it stands — a reported figure traceable to the HHS filing, not one we verified at the source.

Hillcrest Convalescent Center is a nursing and rehabilitation facility in Durham, North Carolina. The exposed categories include medical treatment and health insurance information, which is a different and more durable kind of exposure than a leaked email address — it does not expire the way a card number does.