University of Hawai’i Data Breach

A court authorized a Notice because you have the right to know about the Settlement, and all your rights and options, before the Court decides whether to grant Final Approval of the Settlement. The Notice explains the nature of the Action that is the subject of the Settlement, the general terms of the Settlement, and your legal rights and options.

The Honorable Steven Nichols of the First Judicial Circuit Court for the State of Hawai'i is overseeing the case captioned as In re University of Hawai'i Data Breach Litigation, Civil No. 1CCV-26-0000280 ("Action"). The individuals who filed this lawsuit are called the Plaintiffs or Class Representatives. The company sued is the University of Hawai'i (Defendant).

The Plaintiffs filed this lawsuit against the Defendant on behalf of themselves and all others similarly situated regarding a cybersecurity incident that occurred on or about August 31, 2025, wherein a third party unlawfully accessed specific University of Hawai'i Cancer Center ("UHCC") servers that support the research operations at the epidemiology division of the UHCC (the "Data Incident"). Certain files that contained Private Information were accessed. The impacted information included names, Social Security numbers, driver's license numbers, and research Private Information. The affected data was contained in research files and was not part of the medical records for patients treated at or in conjunction with UHCC.

Defendant denies any wrongdoing whatsoever. No Court or other judicial body has made any judgment or other determination that Defendant has done anything wrong. The Court has not made any determination of any wrongdoing by Defendant or that any law has been violated. Instead, the Plaintiffs and Defendant have agreed to a settlement to avoid the risk, cost, and time of continuing the lawsuit.

In a class action, one or more people called "class representatives" or "plaintiffs" sue on behalf of all people who have similar claims. Together, all these people are called a "class", and the individuals are "class members." One court resolves the issues for all class members, except for those who timely exclude themselves from the class.

The Court has not decided in favor of the Plaintiffs or Defendant. Instead, both sides have agreed to the Settlement. The Settlement avoids the cost and risk of a trial and related appeals, while providing benefits to Settlement Class Members. The Class Representatives, Defendant, and their lawyers believe the Settlement is best for the Settlement Class because of the Settlement Class Member Benefits available and the risks and uncertainty associated with continuing the Action.

The Settlement Class includes all living individuals in the United States who were notified that their Private Information was potentially compromised in the Data Incident.

Yes. Excluded from the Settlement Class are (a) the judges presiding over this Action, and their immediate family members for whom participation would result in a conflict of interest for the judge; (b) the Defendant, its affiliates, subsidiaries, successors, predecessors, and any entity in which Defendant has a controlling interest, and any of its current officers and members of the Board of Regents, and their immediate family members for whom participation would result in a conflict of interest for the officer or Regent; and (c) Settlement Class Members who submit a valid request for exclusion prior to the Opt-Out Deadline.

If you are still not sure whether you are included in the Settlement Class, you may write to the Settlement Administrator at the following address:

The Settlement Agreement provides for a $3,500,000.00 Settlement Fund, which will be used to pay the following:

(1) all Valid Claims for Settlement Class Member Benefits; (2) all Settlement Administration Costs; and (3) any attorneys' fees, costs, and Service Awards approved by the Court.

The Settlement provides the following Settlement Class Member Benefits:

• Cash Payment A - Extraordinary Documented Losses: Reimbursement up to $5,000.00 for reasonably documented losses per Settlement Class Member that can be reasonably traced to the Data Incident.

  Examples of reasonable documentation include (but are not limited to) telephone records, correspondence including emails, or receipts. Personal certifications, declarations, or affidavits from the Settlement Class Member do not constitute reasonable documentation but may be included to provide clarification, context, or support for other submitted reasonable documentation. You will not be reimbursed for expenses if you have been reimbursed for the same expenses by another source, including compensation provided in connection with the credit monitoring and identity theft protection product offered as part of the notification letter provided by the Defendant or otherwise.

  If you do not submit reasonable documentation supporting a loss, or if your Claim Form is invalid as determined by the Settlement Administrator and you do not cure your Claim Form, your Claim Form will be processed as if you elected Cash Payment B -Alternate Cash.

• Cash Payment B - Alternate Cash: As an alternative to Cash Payment A, without providing documentation, you may submit a claim to receive an alternate cash payment in the estimated amount of $50.00.

  Your Cash Payment B may be subject to a pro rata (a legal term meaning equal share) increase if the value of the Valid Claims submitted does not use the entire Net Settlement Fund. Alternatively, if the value of the Valid Claims exceeds the amount of the Net Settlement Fund, your Cash Payment may be subject to a pro rata reduction.

  For purposes of calculating the pro rata increase or decrease, the Settlement Administrator must distribute the funds in the Net Settlement Fund which includes payment of Settlement Administration Costs, Valid Claims for Cash Payment A, Valid Claims for Medical Data Monitoring, and any attorneys' fees, costs and Service Awards granted by the Court. Any pro rata increases or decreases to Cash Payments will be on an equal percentage basis.

Medical Data Monitoring: All Settlement Class Members may also submit a claim to enroll in one year of CyEx's Medical Shield Pro Medical Data Monitoring service.

Defendant, the State of Hawai'i and its respective affiliates will receive Releases from all Released Claims that could have been or that were brought against Defendant relating to the Data Incident. Thus, if the Settlement becomes final and you do not exclude yourself from the Settlement, you will be a Settlement Class Member and you will give up your right to sue Defendant and the Released Parties for claims associated with the Data Incident. These Releases are described in Section XII of the Agreement which is available here. If you have any questions, you may talk to Class Counsel listed in Question 17 for free or you can talk to your own lawyer.

Section XII of the Settlement Agreement describes the Releases, Released Claims, and Released Parties, so please read carefully. The Settlement Agreement is available here. For questions regarding the Releases, Released Claims, or Released Parties and what the language in the Settlement Agreement means, you may also contact Class Counsel listed below for free, or you can talk to your own lawyer at your own expense.

You must submit a complete and timely Claim Form to receive any Settlement Class Member Benefits as described above. Your Claim Form may be submitted online here by November 2, 2026, or mailed to the Settlement Administrator at the address on the Claim Form, postmarked by November 2, 2026. Claim Forms are also available here or by calling 1-877-417-7187 or by writing to:

Please note per the United States Postal Service, mail may not be postmarked the day it is deposited in a mailbox or at a local post office. Postmarks occur when mail reaches a processing facility. To meet a postmark deadline, mail at least one week prior to a postmark deadline, get a manual postmark in-person at any post office, or send via Certified Mail.

If you change your mailing address or email address after you submit a Claim Form, it is your responsibility to inform the Settlement Administrator of your updated information. You may notify the Settlement Administrator of any changes by writing to the following:

If you file a timely and valid Claim Form, the Settlement Class Member Benefits will be provided after the Settlement is approved by the Court and becomes final.

It may take time for the Settlement to be approved and become final. Please be patient and check back on this website for updates.

If you receive notice of this Settlement and want to maintain any right to sue or continue to sue Defendant and the Released Parties on your own about the legal claims in this Action or the Released Claims, then you must take steps to exclude yourself from the Settlement. This is sometimes also referred to as "opting out" of the Settlement.

To opt out from the Settlement, you must mail a written opt-out request, which includes the following:

1. Your name, address, telephone number, and email address (if any);

2. The Settlement Class Member's personal physical signature;

3. The case name and number: In re University of Hawai'i Data Breach Litigation, Civil No. 1CCV-26-0000280 (1st. Cir. Ct. of Hawai'i.); and

4. A statement that you want to be excluded from the Settlement Class, such as, "I hereby request to be excluded from the Settlement Class in In re University of Hawai'i Data Breach Litigation, Civil No. 1CCV-26-0000280 (1st. Cir. Ct. of Hawai'i.)."

The exclusion request must be mailed to the Settlement Administrator at the following address, and be postmarked by October 19, 2026:

You cannot opt out (exclude yourself) by telephone or by email.

"Mass" or "class" requests for exclusion filed by third parties on behalf of a "mass" or "class" of Settlement Class Members or multiple Settlement Class Members where the opt-out request has not been signed by each individual Settlement Class Member will not be allowed.

Please note per the United States Postal Service, mail may not be postmarked the day it is deposited in a mailbox or at a local post office. Postmarks occur when mail reaches a processing facility. To meet a postmark deadline, mail at least a week prior to a postmark deadline, get a manual postmark in-person at any post office, or send via Certified Mail.

No. If you opt out, you will not receive any Settlement Class Member Benefits, and you will not be bound by the Settlement or any judgments in this Action. You may only receive Settlement Class Member Benefits if you submit a timely and valid Claim Form.

If you opt out, you give up any right to sue the Defendant and Released Parties for the legal claims this Settlement resolves and Releases, and you will be bound by the terms of the Settlement, proceedings, orders, and judgments in the Action. You must opt out of this Action to start or continue your own lawsuit or be part of any other lawsuit against the Released Parties about the Released Claims in this Settlement. If you have a pending lawsuit, speak to your lawyer in that lawsuit immediately.

You may tell the Court that you do not agree with all or any part of the Settlement and/or Application for Attorneys' Fees, Costs, and Service Awards by objecting to the Settlement.

For an objection to be valid under the Settlement, it must be sent to the Clerk of Court, and sent by U.S. Mail to Class Counsel, Defendant's Counsel, and the Settlement Administrator at the addresses below, postmarked no later than October 19, 2026.

To file an objection, you cannot exclude yourself from the Settlement Class. For an objection to be considered by the Court, your objection must be written and must include all the following:

1. The objector's full name, mailing address, telephone number, and email address (if any);

2. The case name and number: In re University of Hawai'i Data Breach Litigation, Civil No. 1CCV-26-0000280 (1st. Cir. Ct. of Hawai'i.);

3. All grounds for the objection, accompanied by any legal support for the objection known to you as the objector or your own lawyer;

4. The number of times you have objected to a class action settlement within the five years preceding the date that you file the objection, the caption of each case in which you have made such objection, and a copy of any orders related to or ruling upon your prior objections that were issued by the trial and appellate courts in each listed case;

5. The identity of all lawyers (if any) representing you in connection with the objection, including any former or current lawyers who may be entitled to compensation for any reason related to the objection to the Settlement and/or Application for Attorneys' Fees, Costs, and Service Awards and whether they will appear at the Final Approval Hearing;

6. The number of times your lawyer or your lawyer's law firm have objected to a class action settlement within the five years preceding the date of the filed objection, the caption of each case in which your lawyer or the firm has made such objection and a copy of any orders related to or ruling upon your lawyer's or the lawyer's law firm's prior objections that were issued by the trial and appellate courts in each listed case;

7. A list of all persons who will be called to testify at the Final Approval Hearing in support of your objection (if any);

8. Whether you and/or your lawyer will appear and/or testify at the Final Approval Hearing and;

9. Your signature as the objector (a lawyer's signature is not sufficient).

Class Counsel and/or Defendant's Counsel may conduct limited discovery on any objector or objector's counsel, including the taking of depositions and propounding document requests.

Objecting is simply telling the Court that you do not like the Settlement or parts of it and why you do not think it should be approved. You can object only if you are a Settlement Class Member. Opting out is telling the Court that you do not want to receive any benefit from the Settlement. If you opt out, you have no basis to object because you are no longer part of the Settlement Class, and the case no longer affects you.

Yes. The Court has appointed Robert M. Hatch and Margery S. Bronster of Bronster Fujichaku Robbins and Caroline Herter of Kopelowitz Ostrow P.A. as Class Counsel to represent you and the Settlement Class for the purposes of this Settlement. You may hire your own lawyer at your own cost if you want someone other than Class Counsel to represent you in this lawsuit.

Class Counsel will file an Application for Attorneys' Fees, Costs, and Service Awards for an award of up to one-third ($1,166,666,67) of the Settlement Fund, plus reimbursement of any costs. Any such award would compensate Class Counsel for investigating the facts, litigating the case, and negotiating the Settlement and will be the only payment to them for their efforts in achieving this Settlement and for their risk in undertaking this representation on a wholly contingent basis.

Class Counsel will also ask the Court to approve up to $2,000.00 Service Awards for each of the Class Representatives for their efforts.

If awarded by the Court, the attorneys' fees and costs and the Service Awards will be paid from the Settlement Fund. The Court may award less than the amounts requested.

The Court will hold a Final Approval Hearing on November 4, 2026, at 9:00 a.m. before the Honorable Steven Nichols at the First Judicial Circuit Court for the State of Hawai'i, Kaahumanu Hale, 777 Punchbowl Street, Honolulu, HI 96813-5093. At this hearing, the Court will consider whether the Settlement is fair, reasonable, and adequate and decide whether to finally approve the Settlement and the Application for Attorneys' Fees, Costs, and Service Awards.

Note: The date and time of the Final Approval Hearing are subject to change without further notice to the Settlement Class. The Court may also decide to hold the hearing via video conference or by telephone. You should check back on this website to confirm the date and time of the Final Approval Hearing have not changed.

No. Class Counsel will answer any questions the Court may have. However, you are welcome to attend at your own expense. If you file an objection, you do not have to attend the Final Approval Hearing to speak about it. If you file your written objection by the deadline, the Court will consider it.

You may ask the Court for permission to speak at the Final Approval Hearing. To do so, you must file an objection according to the instructions in Question 16, including all the information required. Your objection must be mailed to the Clerk of the Court, Class Counsel, Defendant's Counsel, and the Settlement Administrator, at the mailing addresses listed above, postmarked by no later than October 19, 2026.

If you do nothing, you will not receive any benefits from this Settlement. If the Settlement is granted Final Approval and becomes final, you will not be able to start a lawsuit, continue with a lawsuit, or be part of any other lawsuit against Defendant or the other Released Parties based on any claim that could have been or that was brought relating to the Data Incident.

This website summarizes the Settlement. Complete details about the Settlement are provided in the Settlement Agreement. The Settlement Agreement and other related documents are available here. You may also receive additional information by calling toll free 1-877-417-7187, or by writing to the following: