University of Hawaii Data Breach Settlement: $3.5 Million, Claims Due November 2, 2026
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
The University of Hawaii data breach in the news is the August 2025 ransomware attack on the UH Cancer Center’s Epidemiology Division, which reached about 1.2 million people — most of them never patients or students, but people whose old driver’s license and voter records sat in research files. The university settled the class action for $3.5 million. The settlement email is real. Claims are due November 2, 2026: about $50 with no proof, or up to $5,000 for documented losses.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What the University of Hawaii Lawsuit Says Happened
Per UH’s own February 28, 2026 notice, the attack hit servers supporting the UH Cancer Center’s epidemiology research. The exposed files were mostly old recruitment lists: Hawaii driver’s license records collected in 2000 and City and County of Honolulu voter registration records collected in 1998 — at the time, both often carried Social Security numbers. Files for the long-running Multiethnic Cohort Study and other diet-and-cancer studies were also involved, some with health questionnaires.
UH said clinical trials, patient care, other Cancer Center divisions and student records were not affected. UH also said it paid the attackers for a decryption tool and the destruction of the stolen data — a promise that cannot be verified.
The class action alleges UH failed to use reasonable security to protect names, Social Security numbers, driver’s license numbers and research data. Per the Star-Advertiser, the attack was not made public until six months after it occurred. UH denies wrongdoing.
Case Details
The case is In re: University of Hawai’i Data Breach Litigation, No. 1CCV-26-0000280, in the First Circuit Court in Honolulu — a Hawaii state court, not a federal one. The court granted preliminary approval on June 19, 2026. The final approval hearing is set for November 4, 2026.
The official settlement website is UHDataSettlement.com, run by the University of Hawai‘i Data Incident Settlement Administrator (Epiq, per settlement listings), P.O. Box 3719, Portland, OR 97208-3719, phone 1-877-417-7187.
This is not the first University of Hawaii class action over data. Gross v. University of Hawai’i, Civil No. 11-1-1217-06 PWB, covered five breaches from 2009 to 2011 and settled on January 26, 2012 with two years of credit monitoring for about 96,000 people. That case is closed and has nothing to do with the current payments.
Status: Settled, Claims Open Until November 2, 2026
We covered the claim-rate math in our news report on the $3.5 million fund.
Don't miss the claim deadline
Claims are due by November 2, 2026. We'll email you 7 days and 1 day before the deadline.
Who Can File a Claim
The class covers all living individuals in the United States whom UH notified that their information was potentially compromised in the Cancer Center breach. Notice went out in two waves: letters mailed on February 23, 2026 to 87,493 Multiethnic Cohort Study participants, then emails to the roughly 1.15 million others (UH located about 900,000 email addresses).
The practical test is that notice. The settlement email carries a Unique ID and PIN, which you need to file online. If you expected one and didn’t get it, check your spam folder first, then contact the administrator at 1-877-417-7187. Being a UH student, employee or Cancer Center patient does not by itself put you in the class.
How Much the University of Hawaii Settlement Pays
Documented losses: up to $5,000 for unreimbursed losses reasonably traceable to the breach, such as identity theft, fraud, or credit reports and monitoring you paid for. Proof is required — receipts, bank statements, emails.
Cash payment: an estimated $50, no proof required. It is pro rata, so it rises or falls with the number of valid claims.
Medical data monitoring: one year of CyEx Medical Shield Pro, available to all class members.
Everything comes out of the $3.5 million fund. That includes attorneys’ fees of up to $1,166,666.67 plus costs, service awards of up to $2,000 per class representative, and administration costs. With about 1.2 million people eligible, the $50 estimate depends on a low claim rate. Payment options include PayPal, Venmo, Zelle, a digital Mastercard or a paper check.
University of Hawaii Data Breach Timeline
- 1
August 2025 — Ransomware Hits the Cancer Center
Attackers reach servers in the UH Cancer Center’s Epidemiology Division (settlement listings date it August 31, 2025). Files holding names and Social Security numbers are taken.
- 2
February 23, 2026 — First Notice Letters
UH mails letters to 87,493 Multiethnic Cohort Study participants. A public notice follows on February 28, 2026, with email notices to about 900,000 addresses.
- 3
June 19, 2026 — Preliminary Approval
The First Circuit Court preliminarily approves the $3.5 million settlement in case 1CCV-26-0000280.
- 4
August 2026 — Settlement Emails Go Out
Class members receive emails from the University of Hawai‘i Data Incident Settlement Administrator with a Unique ID and PIN.
- 5
October 19, 2026 — Opt-Out and Objection Deadline
The last day to exclude yourself or object. People who opt out get no payment but keep their right to sue on their own.
- 6
November 2 and 4, 2026 — Claims Close, Final Hearing
Claims are due November 2, 2026. The court holds the final approval hearing on November 4, 2026. Payments follow only after final approval and any appeals.
Three Things to Watch For
Many class members were notified by email about records from decades ago, so it is easy to fake a message that sounds plausible:
Look-alike settlement emails
The real email comes from the University of Hawai‘i Data Incident Settlement Administrator and points to UHDataSettlement.com. If you are unsure, don’t click the link — type the address yourself and enter your Unique ID and PIN there. The real site never charges a fee.
Mixing up the call center and the claim
UH’s 2026 breach call center (844-443-0842) offered credit monitoring enrollment. That is not a settlement claim. Signing up there does not get you the $50 or the $5,000 — only a claim filed by November 2, 2026 does.
Calls asking for your full Social Security number
The stolen files already held Social Security numbers, so a caller who knows yours proves nothing. Don’t give your Social Security number to an unsolicited caller or message. Hang up and call 1-877-417-7187 yourself.
University of Hawaii Data Breach — Questions People Actually Ask
Is the University of Hawaii settlement email legit?
Yes. The Honolulu Star-Advertiser confirmed that emails from the University of Hawai‘i Data Incident Settlement Administrator are the real settlement notice. To be safe, go straight to UHDataSettlement.com instead of clicking the link.
I never went to the Cancer Center. Why was my data there?
Most of the people affected were never patients. Researchers recruited study participants using Hawaii driver’s license records from 2000 and Honolulu voter records from 1998, and back then both often included Social Security numbers. Those lists were still in the research files.
How much will I get?
Either an estimated $50 with no proof required, or up to $5,000 for documented losses tied to the breach. All class members can also choose one year of medical data monitoring. The $50 figure is an estimate and changes with the number of claims.
What is the deadline?
Claims are due November 2, 2026, online or postmarked. Opt-outs and objections are due October 19, 2026. After November 2, 2026, the claim period is closed.
When will the University of Hawaii settlement pay?
No payment date has been set. The final approval hearing is November 4, 2026, and payments go out only after final approval and any appeals.
Do I need proof to file a claim?
Not for the cash payment. The documented-loss option, up to $5,000, requires records such as receipts or bank statements showing unreimbursed losses connected to the breach.
I didn’t get an email or letter. Can I still file?
The class is people UH notified. Check your spam folder first, since most notices went by email. Then contact the administrator at 1-877-417-7187 or through UHDataSettlement.com to ask whether you are on the class list.
Is this the same as the old UH data breach lawsuit?
No. Gross v. University of Hawai’i covered breaches from 2009 to 2011 and settled on January 26, 2012 with credit monitoring. The current University of Hawaii lawsuit is about the 2025 Cancer Center attack.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
Open Class Action Settlements
Other settlements taking claims right now, with deadlines
Data Breach Settlement Calculator
Estimate a pro rata cash payment before you file
Settlement Payout Calculator
How fees and claim rates shrink a per-person payment
Southern Illinois University Breach
Another 2026 university breach with Social Security numbers