The Malware That Ate Augusta
ARcare, the Augusta, Arkansas health network, used its April 2022 notice to patients to describe an incident as involving “a limited amount” of personal and medical information, and framed the mailing as something it was doing “out of an abundance of caution.” The press release went up on April 25, 2022, but it didn’t say how many people were affected. The company wouldn’t tell reporters either.
Three years later, the number 345,353 surfaced in a court filing. ARcare ended up paying $3.9 million, and it spent two years of the litigation trying to hand the case to the federal government instead. Every vague sentence in a breach notice potentially becomes an exhibit in the lawsuit that follows, which is worth remembering the next time someone proposes “limited amount” as a talking point.
38 Days of Unauthorized Access
The intrusion ran from January 18 to February 24, 2022, when ARcare discovered a malware infection that had disrupted parts of its network. The notice says the review wrapped on April 4, and letters went out April 25. That’s 60 days after discovery, right on the outer edge of the window the Health Insurance Portability and Accountability Act (HIPAA) Breach Notification Rule allows for individual notice. The company said at the time it had no evidence the information had been misused, a caveat that shows up in nearly every breach notice and rarely holds up. What the intruders reached:
- Social Security numbers and driver’s license numbers
- Dates of birth, financial account numbers, and health insurance identifiers
- Medical treatment and diagnosis records, along with prescription information
The consolidated complaint alleges the data wasn’t encrypted and that ARcare had no business storing Social Security numbers in readable form. It also describes what the harm looks like for one patient. A named plaintiff says she received a $65 bill for medical services she never got, which is the sort of small-dollar mess that takes months to unwind and leaves a permanent mark on a medical record.
Out of an Abundance of Caution
The Northwest Arkansas Democrat-Gazette asked how many patients were affected and whether the breach touched the whole organization. According to the paper’s April 28, 2022 story, ARcare replied that it “does not share details about its network architecture for security purposes.” Nobody asked about network architecture. The question was how many people were getting letters, and whether the whole organization was hit. The company wouldn’t say, and it wouldn’t discuss which safeguards were in place.
“ARcare does not share details about its network architecture for security purposes.”
The notice promised twelve months of free credit monitoring through IDX and a dedicated call center. Scope stayed private until plaintiffs’ lawyers put a number in a filing. By the time the settlement website posted it, the figure was no longer a secret anyone was keeping. Litigation did what a press inquiry couldn’t.
Five Lawsuits and a Two-Year Detour
Hale v. ARcare started in May 2022, and four more complaints followed. By March 2023 the court had consolidated them into Case No. 3:22-cv-00117 in the Eastern District of Arkansas, with five named plaintiffs carrying the claims. Then came the detour.
ARcare moved to substitute the United States as the defendant in its place. The court denied that motion in March 2024. ARcare appealed to the Eighth Circuit, and the case sat stayed from April 2024 until June 2026, when the appellate court affirmed and denied rehearing. Two years of a five-year timeline went to an argument that lost. For the class, the appeal produced no ruling on the merits, only delay. Mediation before retired Judge Wayne Andersen ran nearly a full day and generated the deal the parties filed on July 30, 2026. The court granted preliminary approval on August 3, and notice went out October 9.
The Timeline at a Glance
| Date | Event |
|---|---|
| Jan 18 – Feb 24, 2022 | Malware runs on ARcare’s network |
| Apr 25, 2022 | Patient notification begins |
| May 2022 | First class action filed (Hale) |
| Mar 2023 | Cases consolidated |
| Mar 2024 | US substitution motion denied |
| Apr 2024 – Jun 2026 | Case stayed during appeal |
| Jul 30, 2026 | Settlement agreement signed |
| Aug 3, 2026 | Preliminary approval |
| Oct 9, 2026 | Class notice mailed and emailed |
| Dec 8, 2026 | Objection and exclusion deadline |
| Jan 7, 2027 | Claim filing deadline |
| Jan 28, 2027 | Final approval hearing |
The docket has the full sequence.
What $3.9 Million Buys
Divide the $3.9 million fund by 345,353 class members and you get about $11.30 apiece, before anything comes off the top.
| Deduction | Amount |
|---|---|
| Attorneys’ fees | Up to $1.3 million |
| Litigation expenses | Up to $50,000 |
| Service awards (5 x $2,500) | $12,500 |
| Administration and monitoring costs | Paid from the fund |
The settlement agreement and the FAQ lay out the benefits in a payment order:
- Medical data monitoring gets funded first
- Documented losses capped at $5,000, with receipts and supporting paperwork
- An estimated $100 alternate cash payment that shrinks if claims outrun the fund
Anyone who misses the January 7, 2027 claim deadline keeps the release and gets nothing, and people who never open the envelope are bound anyway. The fund is non-reversionary, so unclaimed money goes to Legal Aid of Arkansas instead of back to ARcare. The release covers claims known and unknown, and for members of the California subclass it includes an explicit waiver of California Civil Code Section 1542.
The Monitoring Loops Back on Itself
In 2022 ARcare offered twelve months of credit monitoring through IDX. The consolidated complaint called that “wholly inadequate,” pointing to Government Accountability Office findings that stolen records can sit dormant for a year or longer before surfacing in fraud. The settlement delivers one year of CyEx medical data monitoring instead.
Twelve months in 2022. Twelve months in 2026.
The product itself suits a medical breach better than generic credit monitoring does, with dark web scanning and $1 million in identity theft insurance attached. Medical monitoring addresses a real gap, since a credit freeze won’t catch a fraudulent procedure billed to your insurance. What changed between 2022 and 2026 isn’t the remedy; it’s the $3.9 million sitting next to it.
Disclose Your AI Before You Object
Objections and exclusion requests are due December 8, 2026, and the preliminary approval order attaches conditions that read like a deposition outline. An objector has to disclose any objection filed in the past five years, name their lawyer, list the witnesses they plan to call, and certify whether artificial intelligence was used to prepare the objection.
That last requirement keeps showing up in federal courtrooms, and here it applies to a pool of roughly 345,000 people, most of whom will never retain counsel and might instead ask their friend Claude for legal advice. Opting out preserves an individual claim and forfeits the settlement benefits. The settlement site lists the rest of the requirements.
What Comes Next
Judge Brian S. Miller will hold the final approval hearing on January 28, 2027, in Little Rock, with the deadlines posted on the settlement site. Payments go out once the judgment is final and any appeal resolves. Given this docket’s history, a clean path to that point is not a safe bet. ARcare admits no wrongdoing. The security improvements it agreed to make get documented in a written declaration delivered to Class Counsel rather than filed with the court, so the specifics never become public. The class walks away with a small amount of cash, a year of monitoring, and a release covering claims that haven’t occurred to anyone yet.
