Patients caught up in a 2025 ransomware attack on Highlands Oncology Group can claim up to $4,250 for documented losses under a settlement that won preliminary court approval, with cash-only claims worth about $50 each available as an alternative. The deal also includes three years of medical data monitoring and a $1M identity theft insurance policy for roughly 113,575 affected individuals.
The Arkansas cancer care and research practice, which serves Northwest Arkansas, Southwest Missouri, and Southeast Oklahoma, discovered the intrusion around June 2, 2025. Investigators later determined the attackers first reached its network as early as January 21, 2025. Stolen data spanned names, birth dates, Social Security numbers, driver’s license and state ID numbers, passport numbers, payment card and financial account numbers, medical treatment information, medical record and patient account numbers, and health insurance policy details.
Notifications went out August 1, 2025, and 13 class action complaints followed, later consolidated in the Circuit Court for Washington County, Arkansas. The practice moved to dismiss the case but shifted to mediation, and the resulting agreement now awaits a final fairness hearing scheduled for November 6, 2026.
Class members must file claims by October 22, 2026, and the opt-out and objection deadline is October 7, 2026. The practice will cover attorneys’ fees, administrative costs, and service awards. The deal closes out a case load that has been working through the Arkansas courts for more than a year, one of several 2025 healthcare ransomware attacks still producing settlement activity in 2026.
