The settlement was the result of a data breach that disrupted the nonprofit's operations in 2022.

 

What happened

A district judge in Arkansas has given preliminary approval to ARcare to resolve the complaint Hale, et al. v. ARcare, Inc. The single suit was the result of multiple class action suits that were filed following the 2022 breach. The consolidated suit argued that ARcare could have prevented the breach, among other claims of negligence, breach of implied contract, and more. ARcare attempted to have the lawsuit dismissed, but their motion was denied.

All parties agreed to a mediation, which resulted in ARcare agreeing to establish a $3.9 million settlement fund that will go towards attorneys’ fees and expenses, settlement administration costs, and awards to class members and plaintiffs. A final approval hearing is scheduled for January 28th, 2027.

 

The backstory

ARcare, a nonprofit, federally qualified community health center, first identified unauthorized access to its computer network on February 24th, 2022. The breach caused a temporary disruption of operations, but the disruption was resolved within the day.

An investigation determined that an unauthorized party had accessed ARcare’s network between January 18th and February 24th, resulting in data being accessed for 345,000 individuals. Data accessed included names, dates of birth, driver’s license numbers, Social Security numbers, medical information, financial account information, and health insurance information. Ultimately, no threat group claimed responsibility for the incident.

 

Why it matters

This settlement joins a myriad of other lawsuits that have been the result of rising data breaches. While breaches happen nearly every day (in September of 2026, for instance, 47 breaches were reported to the Department of Health and Human Services), each incident has a unique impact on individuals and the victimized company. It’s difficult to know how many instances of identity theft are the result of data breaches; the Justice Department notes that victims of multiple types of identity theft are more likely than victims of single theft types, like credit card or bank theft, to learn that their personal information had been exposed in a data breach.

Outside of the lawsuit itself, data breaches can have long-lasting implications on how an organization operates. Delays in care and the knowledge that data has been exposed can result in a loss of patient trust, which can be especially detrimental to communities that rely on nonprofit care to receive their services.

 

The big picture

Just in November of 2026, Paubox has reported on multiple large class action lawsuits that have consistently resulted in millions of dollars in settlements. Large settlements include the GoodRx case, still pending approval, that resulted in a $32 million settlement, as well as the Conduent lawsuit over a 2024 breach that resulted in an $80 million settlement. Any healthcare organization that experiences a data breach, no matter if it appears minor or only affects a small number of patients, should expect a legal and often financial consequence. Once a data breach has happened, the ball immediately starts rolling, which is why organizations have to prioritize prevention. Despite threat actors growing more sophisticated, organizations that work with Paubox have still never experienced a data breach connected to email, showing that even as attack strategies evolve, so do prevention methods.

 

FAQs

What does it mean for an organization to be a federally qualified health center (FQHC)?

An FQHC is an organization that receives federal funding to provide care to communities regardless of their ability to pay. These organizations are specifically designed to help underserved communities receive care that they may not otherwise be able to.

 

Why wouldn’t a threat group want to claim an attack?

Some groups will claim an attack for publicity, especially if they are demanding a ransom and want to increase pressure on their victims. However, other threat organizations don’t want to draw attention to themselves, preferring to simply steal and sell the data. These threat groups are harder to trace and less likely to draw attention from authorities.