The $40 in this settlement cannot shrink, because there is nothing for it to shrink out of. The Valley Oaks notice discloses no settlement fund, no aggregate cap and no pro rata reduction clause — which is genuinely uncommon in a data breach settlement, where a published per-person figure is usually an estimate that gets cut once the claim count is known. The second unusual thing: every deadline lands on the same day, November 9, 2026, so a late reader has not already lost the right to opt out.
Status: Claims open | Claim, opt-out and objection deadline all November 9, 2026 | $40 flat, or up to $5,580 documented
What Happened
The lawsuit alleges that during a June 2023 targeted cyberattack on Valley Oaks’ computer systems, certain files containing private information were accessed. The case is In re: Valley Oaks Data Incident Litigation, Case No. 79D01-2403-PL-00032, in the Superior Court No. 1 for Tippecanoe County, Indiana, and Simpluris is administering the settlement.
Valley Oaks denies that it did anything wrong, and the court has not decided who is right. The notice states that the parties agreed to settle to avoid the costs and risks, disruptions and uncertainties of continuing the litigation, and that the court did not decide whether the plaintiffs or the defendant are right. No finding of liability has been made against the company.
The Notice Describes the Exposed Data Two Different Ways
This is worth flagging before anything else, because it changes how a class member should read the rest of the document.
The summary on the notice’s first page says the files may have contained name, date of birth, Social Security number, patient account number, medical diagnosis and clinical information.
Its answer to what the lawsuit is about lists something quite different: Social Security number; driver’s license number; state identification card number or other government-issued identification number; account number; credit or debit card number together with a required security code; an access code or password permitting access to financial information; biometric data; DNA profile; and a username or email address together with a credential permitting access to an online account.
The second list reads like the statutory definition of private information the complaint pleaded rather than a finding about these particular files, which is a common way for the two to diverge in a settlement notice. Neither list is presented as complete for any one person, and nothing in the notice or on the settlement website says which categories applied to which class members. Anyone who wants to know what was in their own file should ask the settlement administrator directly — that is a question the published documents do not answer.
Who Is In the Class
The court defined the class as all persons whose private information was potentially compromised as a result of the incident and who are included on the Settlement Class List.
Both halves matter, and the second does most of the work: membership is not a judgment call about whether your information was in the files, it is a question of whether the administrator’s list has your name on it. The Login ID and PIN printed on the mailed notice are the practical signal, and the notice says Valley Oaks’ records indicate a recipient is a class member entitled to benefits.
The notice also says class members may have received an earlier notice directly from Valley Oaks, separate from the court-authorized one. That earlier letter is not the claim notice and does not carry the credentials the claim form asks for.
Excluded are the judge assigned to evaluate the fairness of the settlement, court personnel and their immediate family members; Valley Oaks, any entity in which Valley Oaks Health, Inc. has a controlling interest, any parent, subsidiary or entity it controls, and the affiliates, legal representatives, attorneys, heirs, predecessors, successors and assigns of Valley Oaks; and anyone found guilty under criminal law of initiating, causing, aiding or abetting the criminal activity behind the incident, or who pleads nolo contendere to such a charge.
One Branching Decision, One Benefit Outside It
The cash options are alternatives to each other:
| Alternative Cash Payment — $40 | A one-time payment claimed instead of any other payment. The notice says no proof or explanation is required. |
| Ordinary out-of-pocket losses — up to $500 | Actual, documented, unreimbursed expenses caused by the incident and incurred between June 8, 2023 and November 9, 2026. |
| Extraordinary out-of-pocket losses — up to $5,000 | Money lost to identity theft or fraud in the same window, where the loss is not already covered by the ordinary tier. |
| Lost time — up to $80 | Up to four hours at $20.00 per hour, with a brief description of how the time was spent. Examples the notice gives: changing passwords, investigating suspicious account activity, researching the incident. |
The three documented tiers are described in the notice as things a class member can claim together; the $40 is described as a payment taken instead of any of them. So the decision is simply whether what the incident actually cost you comes to more than $40. For most people who never saw a fraudulent charge it does not. For anyone who bought a credit monitoring subscription, paid a bureau to freeze and unfreeze their credit, replaced a driver’s license, or spent an afternoon on the phone with a bank, it usually does.
The two-year medical monitoring benefit sits outside that choice. The notice says all settlement class members are eligible to enroll in medical monitoring services and one or more of the cash payment options, so the coverage is not what the $40 trades away. It is CyEx Medical Shield Pro, with $1 million of medical identity theft insurance, monitoring for healthcare insurance ID exposure, Medical Record Number exposure and unauthorized Health Savings Account spending, and access to a fraud resolution agent if something surfaces. That is a closer fit to a file that held patient account numbers and clinical information than credit monitoring is — the risk being watched for is someone else’s care being billed to your policy and ending up in your record.
Why the $40 Is Not an Estimate
There is no common settlement fund here. The notice discloses no total settlement amount, no aggregate cap on the cash benefits and no pro rata reduction clause. The only ceilings stated anywhere in the official documents are the per-person ones — $40, $500, $5,000 and $80.
The attorneys’ fees and service awards are paid by Valley Oaks separately rather than taken off the top of anything a class member receives. Class counsel will ask the court to approve $450,000.00 as reasonable attorneys’ fees and reimbursement of litigation costs, plus service award payments of $2,500.00 for each class representative, and the notice states that both will be paid by Valley Oaks. The court appointed Lynn A. Toops of CohenMalad, LLP as class counsel.
That structure is the reason the per-person figures on this page are ceilings rather than estimates. On a common-fund settlement, fees and service awards come off the top of a fixed pot before any claimant is paid, which is why so many advertised flat payments shrink later. Nothing described in this notice is deducted from what a class member gets.
One Figure Is Stated Two Ways — Check It Before You File
The notice and the settlement website’s FAQ page both describe the lost-time benefit as a maximum of $80.00 with no reference to any shared limit. The claim-form landing page on the same website adds a parenthetical that lost time combined with ordinary out-of-pocket losses is capped at $500.00 in total.
The two readings only diverge for someone claiming close to $500 in ordinary losses and the full four hours. Anyone in that position should raise it with the settlement administrator through the official settlement website before filing rather than assume the looser version holds.
Filing Online Needs a Login ID and PIN
The claim form login screen requires the Login ID and PIN printed on the notice sent to you, which is why this settlement is proof-required even though the $40 itself asks for no documentation and no explanation. The paper route is looser — the same site hosts a downloadable claim form that can be printed, completed, signed and returned by mail with any supporting documentation — but an envelope is not an open online door.
Past that credential, the documentation burden splits by benefit. The $40 and the medical monitoring need nothing. The ordinary tier needs receipts showing what you spent and that the expense was because of the incident. The extraordinary tier needs the same kind of proof plus a showing that the theft or fraud was probably caused by the incident, that the loss is not already covered by the ordinary tier, and that you tried to prevent the loss or recover the money, such as through insurance you already have. Lost time needs only a brief description.
The documented tiers carry a limit worth reading twice: notes or papers you made yourself are not enough on their own. Expenses already reimbursed by a third party are out, and every claimed loss has to fall inside the June 8, 2023 to November 9, 2026 window.
Three Deadlines, One Day
| November 9, 2026 | Submit a claim — online, or postmarked with supporting documentation. |
| November 9, 2026 | Opt out. A written Request for Exclusion carrying the case name and number, your full name, mailing address, telephone number and email address, your personal wet ink signature, and the words “Request for Exclusion” or a clear equivalent. Electronic and typed signatures are not sufficient, and you may exclude only yourself. |
| November 9, 2026 | Object. A complete objection filed with the Clerk of Court, with a copy to the settlement administrator. |
| December 10, 2026, 2:00 p.m. ET | Final approval hearing, Superior Court No. 1 for Tippecanoe County, in Lafayette, Indiana. |
On most settlements the exclusion deadline lands weeks before the claim deadline, so someone who reads their notice late finds the decision to leave the class already made for them by the calendar. That does not happen here. Objecting does not cost you the money — an objector stays in the class and can still file a claim — while opting out means no settlement benefits at all.
Objecting demands considerably more than an opinion. Beyond the case details and your own contact information, the notice requires information proving you are a class member, such as a notice you received; whether the objection applies only to you or to other class members as well; a clear description of every reason you object with any legal support; the name, bar number and contact information of any lawyer you hired for the objection; the names, courts and civil action numbers of every other class action settlement you or your lawyer have objected to; whether you or your lawyer want to speak at the hearing; a full list of any witnesses or documents you plan to present; and your own wet ink signature, which a lawyer’s signature cannot substitute for. The notice says the objection must meet each of those requirements to be valid.
What You Give Up
Staying in the class means you cannot be part of any other lawsuit against Valley Oaks about the issues this settlement covers. The notice points to the releases section of the settlement agreement, Section V, as the definition of the claims given up, and directs class members to the agreement itself for the text.
A release in a data breach settlement normally reaches harm that has not surfaced yet. A fraudulent medical bill that appears in 2029 and traces back to this incident is the kind of claim these releases are written to cover, and it is worth reading Section V on the settlement website before deciding.
Doing nothing does not avoid the release. A class member who never files still gives up those claims and is still bound by the court’s orders — they simply receive nothing in exchange. The only way to keep the right to sue Valley Oaks individually is to opt out by November 9, 2026, which forfeits the cash and the monitoring alike. Given that the $40 requires no proof and no explanation, doing nothing is the one option with no upside.
What Happens Next
At the December 10, 2026 hearing the court will decide whether to approve the settlement, will rule on how class counsel should be paid and on whether to award the service award payments, and will consider any timely objections. Nobody is required to attend. The notice warns that the date and time may change without further notice, with any change posted on the settlement website.
If approval is granted, there may be appeals. The notice says plainly that it is not known whether appeals will be filed or how long they would take to resolve, and that settlement payments are distributed only if the court grants final approval and after any appeals are resolved. No payment date has been announced.
How to File
Claims go through the official settlement website, ValleyOaksDataSettlement.com, administered by Simpluris. Log in with the Login ID and PIN from your notice, choose either the $40 Alternative Cash Payment or the documented tiers, and claim the two years of medical monitoring on the same form. A downloadable claim form can be printed and mailed instead, postmarked by November 9, 2026. Keep a copy of whatever you submit. Filing is free, and class members are not charged for class counsel’s services.
Frequently Asked Questions
Can I claim the $40 and the reimbursements at the same time?
No. The notice describes the Alternative Cash Payment as a one-time $40.00 payment claimed instead of any other payments, so it rules out the ordinary out-of-pocket, extraordinary out-of-pocket and lost-time benefits rather than stacking with them. The medical monitoring is described differently: the notice says all settlement class members are eligible to enroll in medical monitoring services and one or more of the cash payment options, so the two years of coverage is not what the $40 trades away.
Is there a settlement fund, and can my payment shrink if too many people file?
The notice discloses no total settlement amount, no aggregate cap on the cash benefits and no pro rata reduction clause. That is unusual for a data breach settlement, where a fixed fund normally means published payment figures get cut once the claim count is known. The per-person ceilings – $40, $500, $5,000 and $80 – are the only limits stated in the notice or on the settlement website, and the attorneys’ fees and service awards are paid by Valley Oaks separately rather than deducted from class benefits.
Do I have to file a claim to get the two years of medical monitoring?
Yes. The notice says the only way to receive benefits or payments from this settlement is by submitting a valid and timely claim form, and its answer on doing nothing says a class member who does nothing will not receive a benefit. Nothing in the notice or on the settlement website describes a separate enrollment route for the monitoring, so the claim form is how both the coverage and any cash are requested. Claiming the monitoring requires no documentation at all.
Is the lost-time payment capped at $80, or does it share a $500 cap?
The official sources say both, and the difference is worth knowing before filing. The notice and the settlement website’s FAQ page describe lost time as up to four hours at $20.00 per hour for a maximum of $80.00, with no reference to any shared limit. The claim-form landing page on the same website adds a parenthetical that the lost-time payment combined with ordinary out-of-pocket losses is capped at $500.00 in total. Anyone claiming close to $500 in ordinary losses plus the full four hours should put the question to the settlement administrator before the deadline.
What information was actually exposed in the Valley Oaks incident?
The court-authorized notice describes it two different ways. Its summary page says the files may have contained name, date of birth, Social Security number, patient account number, medical diagnosis and clinical information. Its answer to what the lawsuit is about instead lists Social Security number, driver’s license or state identification number, other government-issued identification number, account number, credit or debit card number with a security code, access code or password permitting access to financial information, biometric data, DNA profile, and a username or email address with a credential permitting access to an online account. Neither list is presented as complete for any individual.
What is CyEx Medical Shield Pro and how is it different from credit monitoring?
It is medical identity monitoring rather than credit monitoring. The notice says the two-year service comes with $1 million of medical identity theft insurance and watches for healthcare insurance ID exposure, Medical Record Number exposure and unauthorized Health Savings Account spending, with a fraud resolution agent available if something surfaces. Those are the specific risks in a file that held patient account numbers and clinical information, which ordinary three-bureau credit monitoring does not watch for.
What happens if I do nothing at all?
You receive nothing and you still give up the claims the settlement releases. The notice states that a class member who does nothing will not receive a benefit and will also give up the rights described in its release answer, which means being bound by the outcome without the $40, the reimbursement tiers or the two years of medical monitoring. The only way to keep the right to sue Valley Oaks individually is a written Request for Exclusion carrying a wet ink signature, and that deadline is the same November 9, 2026 as the claim deadline.
Sources
- Official settlement website — ValleyOaksDataSettlement.com, including its home, FAQ, important documents, important dates and claim form login pages. Administered by Simpluris.
- Notice of Proposed Class Action Settlement, In re: Valley Oaks Data Incident Litigation, Case No. 79D01-2403-PL-00032 (Ind. Super. Ct., Tippecanoe Cnty., Superior Court No. 1).
- Settlement Agreement and Release, Section V (Releases), same case.
- Federal Trade Commission — IdentityTheft.gov recovery steps.
- U.S. Department of Health and Human Services — health information privacy for individuals.
- OpenClassActions.com — Valley Oaks Data Breach Settlement.
Source and credit: the settlement terms, deadlines and benefit tiers described above are drawn from our sister site’s reporting — OpenClassActions.com: Valley Oaks Data Breach Settlement — $40 or Up to $5,000 — which tracks this case against the court-approved notice and the official settlement website and is updated as the court rules.
Legal Disclaimer
This article is for informational purposes only and is not legal advice. OpenClassActions.org is a consumer news site, not a law firm and not the settlement administrator, and is not affiliated with any party to the case described. The allegations are allegations; the defendants deny wrongdoing and no court has decided the merits. Deadlines, benefit amounts and payment timing can change as the court and the administrator act, so confirm current status on the official settlement website. You never need to pay anyone to file a claim or to receive a settlement payment.