The Arisa Health data breach settlement resolved a class action over a March 2024 ransomware attack that exposed the personal and medical information of 375,436 patients of the Arkansas nonprofit behavioral health system. Arisa Health agreed to pay $1.9 million into a non-reversionary fund, an Arkansas judge granted final approval on October 21, 2025, and benefits were distributed to class members on February 6, 2026.1Arisa Health Data Incident. Arisa Health Data Incident Settlement
Who Was Covered and What Was Exposed
An unauthorized party accessed Arisa Health’s network between March 1 and March 18, 2024. The ransomware group Hunters International claimed responsibility.2HIPAA Journal. Arisa Health Data Breach Affects 375K A forensic investigation found that the accessed files contained patient names, Social Security numbers, dates of birth, addresses, email addresses, driver’s license numbers, medical record numbers, health insurance information, medical histories and diagnoses, and certifications of substance abuse program completion.3HIPAA Journal. Arisa Health Data Breach Settlement
The settlement class covered every individual Arisa Health identified as affected and sent a notice to. Patients of Arisa’s four subsidiaries were included: Counseling Associates, Mid-South Health Systems (Northeast Arkansas Community Mental Health Center), Ozark Guidance, and Professional Counseling Associates.4ClassAction.org. Arisa Health Data Incident Notice
What Class Members Could Claim
Eligible class members could choose one or more of three benefits from the common fund:
- A cash payment estimated at $70 per person, with no documentation required. The final amount was subject to adjustment depending on the number of valid claims, because the fund was designed to be fully exhausted.
- Reimbursement of up to $5,000 per person for documented out-of-pocket losses traceable to the breach, including unreimbursed fraud losses, post-breach credit monitoring costs, and bank fees. Supporting documentation was required.
- Three years of one-bureau credit monitoring, delivered through an enrollment code sent by email.
Kroll Settlement Administration LLC handled claims, which could be submitted online or by mail.5ClassAction.org. Miller v. Arisa Health Claim Form
Key Deadlines and Approval
The court granted preliminary approval on May 14, 2025.6ClassAction.org. Miller v. Arisa Health Order Granting Preliminary Approval Class members had to opt out by August 12, 2025, and claims were due by August 27, 2025. Final approval followed on October 21, 2025, and payments went out February 6, 2026. If you did not file a claim by the August 27, 2025 deadline, the claims window is closed.
Attorney Fees and Service Awards
At the final approval hearing, the court awarded class counsel $665,000 in attorney fees and $22,055.26 in expenses. Each of the eleven named plaintiffs received a $2,500 service award.7Mealeys. $1.9M Settlement Approved in Class Action Over Medical Patient Data Breach
What the Lawsuit Alleged
The case, Rebecca Miller et al. v. Arisa Health, Inc., Case No. 36CV-24-177, was filed in the Circuit Court of Johnson County, Arkansas. The plaintiffs alleged that Arisa Health failed to implement adequate data security, did not encrypt patient information, failed to effectively monitor its systems for unauthorized access, and delayed notifying patients.3HIPAA Journal. Arisa Health Data Breach Settlement Arisa Health denied all allegations of wrongdoing and settled to avoid further litigation.8ClassAction.org. Miller v. Arisa Health Settlement Agreement Arisa Health reported the breach to the U.S. Department of Health and Human Services Office for Civil Rights on July 19, 2024.9Springfield News-Leader. Arisa Health Incorporated Data Breach Record Whether a ransom was demanded or paid has not been publicly disclosed.