The University of Hawaii Settlement Email Is Real — and Its $50 Estimate Only Holds If Fewer Than About 4% of the 1.2 Million People Notified File. $3.5 Million Fund, Claims Close November 2.

The question most people bring to this settlement is the one a reader put to the Honolulu Star-Advertiser’s Kokua Line on August 9: is an email from the “University of Hawaiʻi Data Incident Settlement Administrator” legitimate or a scam? The column’s answer: claimants are being notified by email of a proposed class action settlement, and you can go straight to the settlement website instead of clicking. The record backs that up three ways. The university’s own cyberattack page, hawaii.edu/cancercenter/incident, says affected people “started receiving notifications via email during the week of August 3, 2026, regarding participation in a class action settlement” and links to UHDataSettlement.com. The court’s June 19 order appoints Epiq Class Action & Claims Solutions, Inc. as administrator and approves an email notice, a postcard notice with a tear-off claim form, the website and a toll-free line. And the Kokua Line pointed readers to the same site and the same number, 1-877-417-7187.

You do not have to click the link in the email. Type UHDataSettlement.com into your browser, choose Submit a Claim, and enter the 10-character alphanumeric Unique ID and 4-digit PIN printed on your email or postcard. The paper claim form asks for your name, mailing address, phone, email and that Unique ID — not your Social Security number — plus a payment choice. Online claims are due by 11:59 p.m. Eastern time on November 2, 2026 under the settlement agreement, which is 6:59 p.m. in Hawaii by our conversion. Mailed claims go to University of Hawaiʻi Data Incident Settlement Administrator, P.O. Box 3719, Portland, OR 97208-3719; the notice says postmarked by November 2, while the site’s claim page says received by then, so mail at least a week early, as the notice itself advises. Lost your notice? Call 1-877-417-7187 or write to that P.O. box.

Who is covered, in the court’s words: “All living individuals within the United States who were notified that their Private Information was potentially compromised in the Data Incident.” In practice that means the people UH notified in 2026: the 87,493 Multiethnic Cohort Study participants who got letters on February 23, and everyone else reached by email in March or by public notice. Excluded are the presiding judge, UH’s current officers and Regents and conflicted family members, and anyone who opts out.

Two look-alikes cause most of the confusion. The March 2026 message from Kroll (notice@krollnotifications.com, subject “NOTICE OF DATA INCIDENT”) was the breach notice, not the settlement; the 12 months of Experian monitoring it offered had enrollment deadlines of May 31 and June 20, 2026, both past. And the page at hawaii.edu/settlement belongs to a different, 2012 settlement.

The University of Hawaii Cancer Center is a research unit of UH Mānoa. According to the settlement agreement and the university’s own account, on or about August 31, 2025 UH identified a cyberattack isolated to servers supporting the Cancer Center’s Epidemiology Division. UH’s FAQ says the attacker “encrypted large amounts of data, and provided proof that it had potentially exfiltrated a portion of that data.” UH says it obtained a decryption tool and “secured an affirmation that the information accessed was destroyed,” and that, to date, “there is no evidence that any of the information has been published, shared or misused.” Clinical trials, patient care and student records were not affected, and the settlement notice says the data “was not part of the medical records for patients treated at or in conjunction with UHCC.”

Why a cancer research unit held Social Security numbers for more than a million people comes down to study recruiting in the 1990s and early 2000s. UH lists the exposed files: a State Department of Transportation driver’s license file collected in 2000 and a City and County of Honolulu voter registration file collected in 1998, both from an era when those identifiers were typically based on SSNs; files for the Multiethnic Cohort Study, which recruited more than 215,000 people in Hawaii and Los Angeles from 1993 to 1996, and three other diet-and-cancer studies, with SSNs or license numbers alongside names and possibly questionnaires and health information; and two registry files with names and SSNs that stopped taking new names in 1999 and the mid-2000s.

UH first reported the incident to the Legislature on December 24, 2025. Its amended February 2026 report counted 1,153,527 potentially affected people plus the 87,493 study participants who were mailed letters on February 23; public notice followed on February 27, and emails in March (UH says about 900,000 addresses were found and 757,588 validated). Honolulu Civil Beat noted that state law generally gives state agencies 20 days to report such a breach to lawmakers.

The lawsuits came fast. Dana Rosemarie Johnson filed a federal class action on February 11, 2026 (Johnson v. University of Hawaii System, No. 1:26-cv-00066, D. Haw.), which the court docket shows closed on March 3 and the settlement says is no longer pending. Four suits in state court were consolidated on February 25 under interim lead counsel Margery S. Bronster and Robert M. Hatch of Bronster Fujichaku Robbins, and on February 27 — the date UH gives for its public announcement of the breach — the parties filed a joint notice of settlement. Judge Nichols heard the preliminary approval motion on June 10 and dated his order June 19. The class representatives are Malia Morath, Rick Robinson, Jocelyn Lima, Evelyn Gonzalez and Johnson. UH, represented by Shook, Hardy & Bacon and Kobayashi, Sugita & Goda, denies any wrongdoing; the plaintiffs’ memorandum says the settlement is funded entirely from UH’s insurance.

You choose one cash option, and you can add medical data monitoring to either.

Cash Payment A — Extraordinary Documented Losses: up to $5,000 per person “upon presentment of reasonable documentation of losses related to fraud and/or identity theft that can be reasonably traced to the Data Incident.” The claim form spells out what you must show: an actual, documented, unreimbursed loss; that the theft or fraud was a direct result of this incident; and “that you made reasonable efforts to prevent the loss or get your money back, such as by using insurance you already have.” Its categories are professional fees for identity theft or fraud, other fraud losses such as unauthorized charges, bank fees and fees for credit reports or monitoring, and incidentals such as notary, postage, copying and mileage. A personal declaration can add context but does not count as documentation on its own, you must certify the costs are not tied to other breaches, and anything already reimbursed — including through the Experian product in UH’s breach letter — is excluded. There is no separate payment for lost time.

Cash Payment B — Alternate Cash: no documents, “in the estimated amount of $50.00.” The notice says it “may be subject to a pro rata (a legal term meaning equal share) increase if the value of the Valid Claims submitted does not use the entire Net Settlement Fund,” and to a reduction if claims exceed it. If a Cash A claim fails and is not fixed, it is paid as Cash B.

Medical data monitoring: one year of CyEx’s Medical Shield Pro service. It is medical data monitoring, not the credit monitoring UH offered in its breach letter. The activation code arrives by email, and the enrollment link only after final approval; the form states that enrolling “will not subject you to marketing for additional services or any required payments.”

Two mechanics decide what people actually receive. The agreement pays out in a fixed order — administration costs, service awards, attorneys’ fees and costs, monitoring, documented-loss claims, and only then the $50-track claims — so the no-proof payment absorbs every shortfall. And if the administrator sends a notice of deficiency, you have 15 days or until November 2, whichever is later, to fix it. Payment can be by PayPal, Venmo, Zelle, a digital Mastercard or paper check; pick more than one and you get a check.

The number the $50 depends on is the class size, and the court’s order states it: “approximately 1,200,000 Settlement Class Members.” Spread across that class, $3,500,000 is $2.92 per person (our arithmetic; UH’s own counts, 1,153,527 plus 87,493, give 1,241,020 people and $2.82).

Class counsel will ask for up to one-third of the fund, $1,166,666.67, plus litigation costs, and up to $2,000 for each of the five class representatives ($10,000). If the court grants both in full, $2,323,333 remains before Epiq’s administration costs, the monitoring enrollments, the litigation costs and any documented-loss claims, none of which the papers quantify. At $50 a claim, that is room for about 46,500 no-proof claims — roughly 3.9 percent of the class. Past that point at the latest, the $50 shrinks — sooner once the other costs come out.

Our scenarios divide the $2,323,333 by the claim count; real payments will be lower once administration, monitoring, costs and documented-loss claims come out first. The agreement has Epiq report claim counts weekly to the parties but does not require publishing them; the first official count is due in the declaration Epiq prepares before the final approval hearing.

One sentence in the court file deserves a flag. The plaintiffs’ May 11 memorandum says “There is a Cash Payments Fund of $450,000.00, which is the maximum amount Defendant will be obligated to pay under the Agreement for all Cash Payments,” citing paragraph 75 of the agreement. Paragraph 75 contains no such cap, and neither does the notice, the website or the court’s order; $450,000 would cover the $50 for only 9,000 people, by our count. The same filing’s declaration also describes “two free years of Credit Monitoring,” while the agreement provides one year of medical data monitoring. We treat the agreement as controlling — it says it is the parties’ entire agreement — and the final approval motion, due October 5 by our count, is the place to watch for a correction.

As of September 25, 2026, every deadline is still ahead.

Opting out only matters if you want to sue UH on your own; doing nothing keeps you in the class, but without a claim you get nothing and are still bound by the release, which also covers the State of Hawaiʻi. Question 16 of the long-form notice contains a sentence that reads the other way (“If you opt out, you give up any right to sue Defendant and Released Parties”); Question 15 says you “will not be bound by the Settlement,” and the agreement says those who opt out “do not release their individual claims.” If more than 50 people opt out, UH may terminate the deal within 21 days after October 19.

When money could move: the agreement requires benefits to go out no later than 75 days after final approval or 60 days after the Effective Date, whichever is later. If the judge approves on November 4 with no objections, that points to about mid-January 2027; with objections but no appeal, early February 2027; an appeal pushes it further (our arithmetic). Leftover money after 240 days goes to a privacy-related cy pres recipient not yet named.

Do not mix this case up with Gross v. University of Hawaiʻi, Civil No. 11-1-1217-06 PWB, the 2012 settlement for five UH breaches from 2009 to 2011 whose page still sits at hawaii.edu/settlement; with the 2023 Hawaiʻi Community College ransomware attack, which the press reported affected about 28,000 people and which this settlement does not cover; or with the closed federal Johnson case, whose plaintiff is now one of the class representatives in this settlement.

The administrator is Epiq: 1-877-417-7187 (toll-free, 24/7), info@UHDataSettlement.com, P.O. Box 3719, Portland, OR 97208-3719. Court-appointed class counsel are Robert M. Hatch and Margery S. Bronster of Bronster Fujichaku Robbins, 1003 Bishop Street, Suite 2300, Honolulu; the notice also lists Caroline Herter of Kopelowitz Ostrow, P.A.