Tift Regional Health System's $1.2 Million Breach Settlement Pays $75 Without Proof or Up to $5,000 With It — and the Judge Hears the Case on September 14, the Day Before Objections Are Due.

The court-authorised website is TiftDataSettlement.com, run by Simpluris. The settlement papers describe the incident in one sentence — “the targeted cyberattack on Tift's computer systems that occurred in August 2022 (the ‘Data Security Incident’)” — and the class in another: “All individuals residing in the United States whose Private Information may have been compromised or otherwise impacted in the Data Security Incident, including all those who received notice of the breach.” The notice tells recipients that “Tift's records indicate that you are a Class Member” and that they “may have received a previous notice directly from Tift.”

What the settlement papers do not say is how many people that is. The figure on the federal breach portal, as reported by HIPAA Journal on August 25, 2026, is 180,142 individuals notified to the HHS Office for Civil Rights. HIPAA Journal's account of the timeline, which we could not check against the court file because the Tift County docket is not online, is that Tift identified suspicious activity on August 16, 2022, that the network was accessed between August 11 and August 17, 2022, that patients were not notified until August 11, 2023, and that the Hive ransomware group claimed the attack and leaked around a terabyte of data. Two of those dates line up with the settlement itself: the window for documented losses opens on August 11, 2022, the first day of the intrusion, and the wait before the letters — almost exactly a year — is the kind of delay breach complaints routinely plead, though we have not read the consolidated complaint itself.

The litigation ran almost three years. Consolidated suits became one case with four class representatives: Chaka Davis, Brooke Dobbins, Janice Farley and Zoie Walsh. Interim co-lead counsel were appointed, filed a consolidated complaint and met the defendants before mediator Bennett G. Picker on May 16, 2024 — “The day proved long and tedious, with substantial advocacy on both sides. Unfortunately, the Parties were not able to come to an agreement during mediation.” The motion to dismiss was fully briefed, formal discovery followed, and “After months of back and forth, the Parties were able to reach a settlement in principle.” The agreement was finalised in April 2026, the motion for preliminary approval was filed with a supporting declaration dated June 4, and the order was entered on the Tift County docket on June 22, 2026.

Every class member can enroll in “two years of CyEx Medical Shield Complete,” which the notice says “comes with $1 million of medical identity theft insurance” and monitors for health insurance ID exposure, medical record number exposure and “unauthorized Health Savings Account (HSA) spending,” with a fraud resolution agent if something turns up. That is separate from the cash, and you can take both.

The cash is one of two things. A Documented Loss Payment of up to $5,000 covers “actual, documented out-of-pocket losses due to the Data Security Incident” incurred between August 11, 2022 and October 15, 2026 — identity theft or fraud losses, fees for credit reports, monitoring or freezes, ID replacement, postage. The proof has to be real: “You can also send notes or papers you made yourself to explain or support other proof, but those notes or papers alone are not enough to make a valid claim.” Expenses already reimbursed by someone else are out. Or, instead, an Alternative Cash Payment: “It is expected that a significant amount of money will remain in the Settlement Fund after all expenses and all other benefits have been paid. All of this remaining money will be divided equally between everyone who claims an Alternative Cash Payment. This payment is expected to be $75.00, but may be larger or smaller depending on the total claims filed. You do not have to provide any proof or explanation to claim this payment.”

The fund behind those numbers is $1,200,000. Class counsel “will ask the court to approve $360,000.00 as reasonable attorneys' fees, plus reimbursement of litigation costs,” and service awards of $2,500 for each of the four representatives; administration costs also come off the top. Our arithmetic, not the court's: after $360,000 in fees and $10,000 in awards, about $830,000 remains before litigation costs, notice and administration, and before any documented-loss claims are paid. Whatever is left is split equally among the no-proof claimants. If, say, $700,000 reached that pot, $75 each would cover roughly 9,300 claims — about five percent of the 180,142 people HIPAA Journal reports as notified. A higher claim rate means a smaller cheque; a lower one means a larger one. The $75 is an estimate built on a claim rate the notice does not disclose.

The administrator's Important Dates page lists five entries: notification mailing July 17, 2026; final approval hearing September 14, 2026 at 10:00 a.m.; opt-out deadline September 15, 2026; objection deadline September 15, 2026; claim deadline October 15, 2026. Three of the five follow a schedule the preliminary approval order set relative to the notice date: opt-outs and objections 60 days after notice, claims 90 days after. Sixty days from July 17 is September 15 and ninety is October 15, so those match. The order's own schedule contemplated a hearing “no earlier than 90 days after Notice Date” — that would have been mid-October — but the signed order, the long form notice and the FAQ all set September 14. So the judge will hear the case the day before the last day to object or opt out.

In practice that means an objection posted on September 15 is timely under the order but arrives after the hearing. Anyone who wants the court to read it before deciding should file well before the 14th. An objection is filed with the Clerk of the Court, 237 E 2nd St, Tifton, GA 31794 — the notice says to copy the administrator, while the order itself names class counsel and Tift's counsel as the recipients, so serve all three — and must include the case name and number, your contact details, proof you are a class member (the notice will do), the reasons and any legal support, any lawyer's details, a list of other objections in recent years (the notice says five, the order three), whether you want to speak, and your own signature. An opt-out is a signed letter to Tift Data Security Incident Settlement, ATTN: Exclusion Request, P.O. Box 25226, Santa Ana, CA 92799-9958, “submitted, postmarked, or emailed by September 15, 2026,” and you can exclude only yourself. The notice adds that “The date and time of this hearing may change without further notice” and points to the website for updates.

On payment timing the notice is short: “Settlement payments will be distributed if the Court grants final approval, and after any appeals are resolved.” Georgia state-court appeals from a final approval order are possible, and the notice does not estimate their length. With the hearing in mid-September and the claims window running to mid-October, the earliest realistic distribution is in the winter, and only if nobody appeals.

The fastest route is the online form at TiftDataSettlement.com. The paper form — titled “Claim Form and Release” — goes to Tift Data Security Incident Settlement, c/o Settlement Administrator, P.O. Box 25226, Santa Ana, CA 92799-9958, by October 15, 2026 — the notice says postmarked, the claim form itself says received, so mail early; you can ask for a copy by email at info@TiftDataSettlement.com or by calling (833) 421-7345, which the notice says is staffed around the clock. The form asks you to pick one cash option, and the documented-loss option needs the receipts attached.

Class counsel are Gary Mason of Mason LLP, William B. Federman of Federman & Sherwood, Bryan L. Bleichner of Chestnut Cambronne PA and Kevin Laukaitis of Laukaitis Law LLC; you pay them nothing. Tift “denies that it did anything wrong, and the Court has not decided who is right.” Staying in the class and doing nothing means you get no payment and still give up the claims described in Section 4 of the agreement. The structure here — a Simpluris site, a CyEx monitoring product, a no-proof alternative payment next to a documented-loss tier — is the same one we walked through yesterday for Community Dental Care; the differences are the fund size, the estimate and the dates. Our Simpluris page explains how this administrator's postcards and payments look, and the data breach settlement calculator shows how documented losses are usually tiered. Nobody from the administrator will ask you to pay anything to receive a payment.