Judge Approves $3.9M ArCare Data Breach Settlement
A federal court granted preliminary approval to a class-action settlement over a 2022 cyberattack that exposed the data of roughly 345,000 people.
Updated on Nov. 8, 2026 in Cybersecurity
A federal judge granted preliminary approval to a $3.9 million class-action settlement with ArCare, a nonprofit healthcare provider serving Arkansas, Kentucky and Mississippi, over a 2022 data breach. The breach potentially compromised personal and protected health information of approximately 345,000 individuals.
Why it matters
The settlement compensates patients whose names, Social Security numbers, financial account and medical information may have been exposed during an unauthorized network intrusion. ArCare denied wrongdoing, while plaintiffs alleged the provider failed to implement adequate safeguards.
The settlement covers approximately 345,000 potentially affected individuals, with documented losses reimbursed up to $5,000 per person or an estimated $100 pro rata cash payment. The final alternative payment amount remains undetermined and depends on available funds and the number of valid claims.
The players
ArCare
ArCare is a nonprofit healthcare provider headquartered in Augusta, Arkansas, serving patients across Arkansas, Kentucky and Mississippi.
U.S. District Court for the Eastern District of Arkansas
The federal court in Arkansas that consolidated the class-action lawsuits and is overseeing approval of the settlement.
The details
The breach involved unauthorized third-party access to ArCare's network between January 18 and February 24, 2022, when the provider discovered the intrusion. Consolidated lawsuits in the U.S. District Court for the Eastern District of Arkansas alleged inadequate safeguards, and the court rejected ArCare's motion to dismiss before the parties reached a mediated agreement. Eligible individuals may claim documented losses or request a pro rata cash payment, and the settlement fund also covers attorneys' fees, administration costs and service awards, with one year of medical data monitoring offered.
Timeline
January 18 to February 24, 2022: Unauthorized third party accessed ArCare's network.
February 24, 2022: ArCare discovered the unauthorized network access.
December 8, 2026: Deadline to opt out or challenge the settlement.
January 7, 2027: Deadline to submit compensation or monitoring claims.
January 28, 2027: Final fairness hearing on settlement approval.
Big Picture
Healthcare data breach class actions have increasingly been resolved through settlement funds that pay documented losses and pro rata cash claims, a model reflected in this ArCare agreement. The approach shifts the burden of proof from individual patients to the aggregate pool of affected records.
Patients whose information was affected may file a claim for documented losses up to $5,000 or request a pro rata cash payment estimated near $100. Claims and opt-out decisions must be made before the stated deadlines to participate.
The takeaway
Organizations holding sensitive health records face lasting legal and financial exposure from breaches, even when intrusions are contained. Patients should watch settlement deadlines closely and review whether their information was involved.
What happens next
Claims and objection deadlines fall on December 8, 2026 and January 7, 2027, with the final fairness hearing set for January 28, 2027.
Further reading
For related coverage, see Cybersecurity news across Arkansas.
Source note: This article includes information reported by Beinsure: Insurance & InsurTech Media Market Intelligence Platform.
