AM9561 v.02 NOTICE OF PROPOSED CLASS ACTION SETTLEMENT In re University of Hawai‘i Data Breach Litigation Civil No. 1CCV-26-0000280 First Judicial Circuit Court for the State of Hawai‘i A court authorized this Notice. This is not a solicitation from a lawyer. If you were notified that your Private Information was potentially impacted in the August 2025 University of Hawai‘i Data Incident, you are eligible to receive benefits from a class action settlement. • A settlement1 has been reached with the University of Hawai‘i (“Defendant”) in a class action lawsuit. The lawsuit concerns the unauthorized access to and acquisition of Private Information that occurred in August 2025. • Who is a Settlement Class Member? All living individuals within the United States who were notified that their Private Information was potentially compromised in the Data Incident. Excluded from the Settlement Class are (1) the judge presiding over this Action and their immediate family members, for whom participation would result in a conflict of interest for the judge; (2) the Defendant, its affiliates, subsidiaries, successors, and predecessors, any entity in which Defendant has a controlling interest, and any of its current officers and members of the Board of Regents and their immediate family members, for whom participation would result in a conflict of interest for the officer or Regent; and (3) Settlement Class Members who submit a valid request for exclusion prior to the Opt-Out Deadline. • Settlement Class Members are eligible for the following Settlement Class Member Benefits: • Cash Payment A – Extraordinary Documented Losses: Settlement Class Members are eligible to submit a claim for a Cash Payment for Extraordinary Documented Losses for up to $5,000.00 per Settlement Class Member upon presentment of reasonable documentation of losses related to fraud and/or identity theft that can be reasonably traced to the Data Incident. OR • Cash Payment B – Alternate Cash: As an alternative to Cash Payment A (above), a Settlement Class Member may submit a claim to receive Cash Payment B, which is a cash payment in the estimated amount of $50.00. Your alternate cash payment may be subject to a pro rata increase or decrease, depending on the amount available in the Net Settlement Fund. • In addition to a Cash Payment, Settlement Members may enroll in: • Medical Data Monitoring: Settlement Class Members may submit a claim for Medical Data Monitoring, which includes one year of CyEx’s Medical Data Monitoring product. For more information visit UHDataSettlement.com or call 1-877-417-7187. Please read this Notice carefully. Your legal rights will be affected, and you have a choice to make at this time. 1 The Settlement Agreement defines all capitalized terms not otherwise defined in this Notice. The Settlement Agreement is available at UHDataSettlement.com. Questions? Go to UHDataSettlement.com or call 1-877-417-7187 toll-free. 1 AM9562 v.02 YOUR LEGAL RIGHTS & OPTIONS DEADLINE The only way to receive cash and medical data monitoring from this Settlement is to submit a valid and timely Claim Form. Submitted online or SUBMIT A CLAIM To submit a Claim Form online, visit UHDataSettlement.com, postmarked on or before FORM or you can mail a Claim Form to the Settlement Administrator. November 2, 2026 If you do not have a Claim Form or need an additional copy, you may print a Claim Form from the Settlement Website or call the Settlement Administrator to request a paper copy of the Claim Form by mail. You may choose to opt out of the Settlement. If you do so, you retain the right to sue, continue to sue, or participate in EXCLUDE YOURSELF another lawsuit against the Defendant related to the legal Postmarked on or before BY OPTING OUT OF claims resolved by this Settlement at your own expense October 19, 2026 THE CLASS and with counsel of your choosing. If you opt out, you will not receive any benefits and will not be bound by the terms of the Settlement Agreement. You may write to the Court about why you agree or OBJECT TO THE disagree with the Settlement or the Application for SETTLEMENT Attorneys’ Fees, Costs, and Service Awards. The Court Postmarked on or before AND/OR ATTEND THE cannot change the terms of the Settlement. You may October 19, 2026 FINAL APPROVAL also ask to speak at the Final Approval Hearing on HEARING November 4, 2026, at 9 a.m., about the fairness of the Settlement, with or without your own attorney. DO NOTHING You will receive no Settlement Class Member Benefits No Deadline and will be bound by the Settlement and the Releases. • Your rights and options as a Settlement Class Member–and the deadlines to exercise your rights–are explained in this Notice. • The Court must still decide whether to approve the Settlement. Settlement Class Member Benefits will be distributed only if the Court approves the Settlement and after any appeals are resolved. Questions? Go to UHDataSettlement.com or call 1-877-417-7187 toll-free. 2 AM9563 v.02 WHAT THIS NOTICE CONTAINS BASIC INFORMATION..............................................................................................................................................4 WHO IS INCLUDED IN THE SETTLEMENT...............................................................................................................4 THE SETTLEMENT BENEFITS.................................................................................................................................. 5 HOW TO GET BENEFITS FROM THE SETTLEMENT................................................................................................6 EXCLUDE YOURSELF OR OPT-OUT OF THE SETTLEMENT....................................................................................6 OBJECTING TO THE SETTLEMENT.......................................................................................................................... 7 THE LAWYERS REPRESENTING YOU......................................................................................................................9 THE COURT’S FINAL APPROVAL HEARING............................................................................................................9 IF YOU DO NOTHING.................................................................................................................................................9 GET MORE INFORMATION.................................................................................................................................... 10 Questions? Go to UHDataSettlement.com or call 1-877-417-7187 toll-free. 3 AM9564 v.02 Basic Information 1. Why is this Notice being provided? A Court authorized this Notice because you have the right to know about the Settlement and all of your rights and options before the Court decides whether to grant Final Approval of the Settlement. This Notice explains the nature of the Action that is the subject of the Settlement, the general terms of the Settlement, and your legal rights and options. The Honorable Steven Nichols of the First Judicial Circuit Court for the State of Hawai‘i is overseeing the case captioned as In re University of Hawaiʻi Data Breach Litigation, Civil No. 1CCV-26-0000280 (the “Action”). The individuals who filed this lawsuit are called the Plaintiffs or Class Representatives. The company being sued is the University of Hawai‘i (Defendant). 2. What is this Action about? The Plaintiffs filed this lawsuit against the Defendant on behalf of themselves and all others similarly situated regarding a cybersecurity incident that occurred on or about August 31, 2025, wherein a third party unlawfully accessed specific University of Hawai‘i Cancer Center (“UHCC”) servers that support the research operations at the epidemiology division of the UHCC (the “Data Incident”). Certain files that contained Private Information were accessed. The impacted information included names, Social Security numbers, driver’s license numbers, and research-related Private Information. The affected data was contained in research files and was not part of the medical records for patients treated at or in conjunction with UHCC. Defendant denies any wrongdoing whatsoever. No Court or other judicial body has made any judgment or other determination that Defendant has done anything wrong. The Court has not made any determination of any wrongdoing by Defendant or that any law has been violated. Instead, the Plaintiffs and Defendant have agreed to a settlement to avoid the risk, cost, and time of continuing the lawsuit. 3. Why is this Action a class action? In a class action, one or more people called “class representatives” or “plaintiffs” sue on behalf of all people who have similar claims. Together, these people are called a “class,” and the individuals are “class members.” One court resolves the issues for all class members, except for those who timely exclude themselves from the class. 4. Why is there a settlement? The Court has not decided in favor of the Plaintiffs or Defendant. Instead, both sides have agreed to the Settlement. The Settlement avoids the cost and risk of a trial and related appeals, while providing benefits to Settlement Class Members. The Class Representatives, Defendant, and their lawyers believe the Settlement is best for the Settlement Class because of the Settlement Class Member Benefits available and the risks and uncertainty associated with continuing the Action. Who Is Included in the Settlement 5. How do I know if I am included in the Settlement Class? The Settlement Class includes all living individuals in the United States who were notified that their Private Information was potentially compromised in the Data Incident. 6. Are there exceptions to being included in the Settlement Class? Yes. Excluded from the Settlement Class are (1) the judge presiding over this Action and their immediate family members, for whom participation would result in a conflict of interest for the judge; (2) Defendant, its affiliates, subsidiaries, successors, and predecessors, any entity in which Defendant has a controlling interest, and any of its current officers and members of the Board of Regents and their immediate family members, for whom participation would result in a conflict of interest for the officer or Regent; and (3) Settlement Class Members who submit a valid request for exclusion prior to the Opt-Out Deadline. Questions? Go to UHDataSettlement.com or call 1-877-417-7187 toll-free. 4 AM9565 v.02 7. What if I am still not sure whether I am part of the Settlement Class? If you are still not sure whether you are included in the Settlement Class, you may visit UHDataSettlement.com or call 1-877-417-7187 toll-free. The Settlement Benefits 8. What does this Settlement provide? The Settlement Agreement provides for a $3,500,000.00 Settlement Fund, which will be used to pay (1) all Valid Claims for Settlement Class Member Benefits; (2) all Settlement Administration Costs; and (3) any attorneys’ fees, costs, and Service Awards approved by the Court. The Settlement provides the following Settlement Class Member Benefits: 1) Cash Payment A – Extraordinary Documented Losses: Each Settlement Class Member may claim reimbursement of up to $5,000.00 for reasonably documented losses that can be reasonably traced to the Data Incident. Examples of reasonable documentation include (but are not limited to) telephone records, correspondence (including emails), or receipts. Personal certifications, declarations, or affidavits from the Settlement Class Member do not constitute reasonable documentation but may be included to provide clarification, context, or support for other submitted reasonable documentation. You will not be reimbursed for expenses if you have been reimbursed for the same expenses by another source, including compensation provided in connection with the credit monitoring and identity theft protection product offered as part of the notification letter provided by Defendant or otherwise. If you do not submit reasonable documentation supporting a loss, or if your Claim Form is invalid as determined by the Settlement Administrator and you do not cure your Claim Form, your Claim Form will be processed as if you elected Cash Payment B – Alternate Cash. 2) Cash Payment B – Alternate Cash: As an alternative to Cash Payment A, without providing documentation, you may submit a claim to receive an alternate cash payment in the estimated amount of $50.00. Your Cash Payment B may be subject to a pro rata (a legal term meaning equal share) increase if the value of the Valid Claims submitted does not use the entire Net Settlement Fund. Alternatively, if the value of the Valid Claims exceeds the amount of the Net Settlement Fund, your Cash Payment may be subject to a pro rata reduction. For purposes of calculating the pro rata increase or decrease, the Settlement Administrator must distribute the funds in the Net Settlement Fund, which includes payment of Settlement Administration Costs, Valid Claims for Cash Payment A, Valid Claims for Medical Data Monitoring, and any attorneys’ fees, costs, and Service Awards granted by the Court. Any pro rata increases or decreases to Cash Payments will be on an equal percentage basis. 3) Medical Data Monitoring: All Settlement Class Members may also submit a claim to enroll in one year of CyEx’s Medical Shield Pro Medical Data Monitoring service. 9. What am I giving up to receive Settlement Class Member Benefits or stay in the Settlement Class? Defendant, the State of Hawai‘i, and its respective affiliates will receive Releases from all Released Claims that could have been or that were brought against Defendant relating to the Data Incident. Thus, if the Settlement becomes final and you do not exclude yourself from the Settlement, you will be a Settlement Class Member and you will give up your right to sue Defendant and the Released Parties for claims associated with the Data Incident. These Releases are described in Section XII of the Settlement Agreement, which is available at UHDataSettlement.com. If you have any questions, you may talk to Class Counsel listed in Question 19 for free, or you can talk to your own lawyer. Questions? Go to UHDataSettlement.com or call 1-877-417-7187 toll-free. 5 AM9566 v.02 10. What are the Released Claims? Section XII of the Settlement Agreement describes the Releases, Released Claims, and Released Parties, so please read it carefully. The Settlement Agreement is available at UHDataSettlement.com. For questions regarding the Releases, Released Claims, or Released Parties and what the language in the Settlement Agreement means, you may also contact Class Counsel listed in Question 19 for free, or you can talk to your own lawyer at your own expense. How to Get Benefits from the Settlement 11. How do I submit a Claim Form? You must submit a complete and timely Claim Form to receive any Settlement Class Member Benefits as described above. Your Claim Form may be submitted online at UHDataSettlement.com through November 2, 2026, or mailed to the Settlement Administrator at the address on the Claim Form, postmarked by November 2, 2026. Claim Forms are also available at UHDataSettlement.com, by calling 1-877-417-7187, or by writing to the following address: University of Hawai‘i Data Incident Settlement Administrator P.O. Box 3719 Portland, OR 97208-3719 Please note per the United States Postal Service, mail may not be postmarked the day it is deposited in a mailbox or at a local post office. Postmarks occur when mail reaches a processing facility. To meet a postmark deadline, mail at least one week prior to November 2, 2026, get a manual postmark in-person at any post office, or send via Certified Mail. 12. What happens if my contact information changes after I submit a Claim Form? If you change your mailing address or email address after you submit a Claim Form, it is your responsibility to inform the Settlement Administrator of your updated information. You may notify the Settlement Administrator of any changes by writing to the following address: University of Hawai‘i Data Incident Settlement Administrator P.O. Box 3719 Portland, OR 97208-3719 13. When will I receive my Settlement Class Member Benefits? If you file a timely and valid Claim Form, the Settlement Class Member Benefits will be provided after the Settlement is approved by the Court and becomes final. It may take time for the Settlement to be approved and become final. Please be patient and check UHDataSettlement.com for updates. Exclude Yourself or Opt-Out of the Settlement 14. How do I opt out of the Settlement? If you receive notice of this Settlement and want to maintain any right to sue or continue to sue Defendant and the Released Parties on your own about the legal claims in this Action or the Released Claims, you must take steps to exclude yourself from the Settlement. This is also referred to as “opting out” of the Settlement. Questions? Go to UHDataSettlement.com or call 1-877-417-7187 toll-free. 6 AM9567 v.02 To opt out of the Settlement, you must mail a written opt-out request that includes the following: 1) Your name, address, telephone number, and email address (if any) 2) The Settlement Class Member’s personal physical signature 3) The case name and number: In re University of Hawai‘i Data Breach Litigation, Civil No. 1CCV-26-0000280 (1st. Cir. Ct. of Hawai‘i) 4) A statement that you want to be excluded from the Settlement Class, such as “I hereby request to be excluded from the Settlement Class in In re University of Hawaiʻi Data Breach Litigation, Civil No. 1CCV-26-0000280 (1st. Cir. Ct. of Hawai‘i).” The exclusion request must be mailed to the Settlement Administrator at the following address, postmarked by October 19, 2026: University of Hawaiʻi Data Incident Settlement Administrator P.O. Box 3719 Portland, OR 97208-3719 You cannot opt out (exclude yourself) by telephone or email. “Mass” or “class” requests for exclusion filed by third parties on behalf of a “mass” or “class” of Settlement Class Members or multiple Settlement Class Members where the opt-out has not been signed by each and every individual Settlement Class Member will not be allowed. Please note per the United States Postal Service, mail may not be postmarked the day it is deposited in a mailbox or at a local post office. Postmarks occur when mail reaches a processing facility. To meet a postmark deadline, mail at least a week prior to October 19, 2026, get a manual postmark in-person at any post office, or send via Certified Mail. 15. If I opt out, will I still get something from the Settlement? No. If you opt out, you will not receive any Settlement Class Member Benefits, and you will not be bound by the Settlement or any judgments in this Action. You may only receive Settlement Class Member Benefits if you submit a timely and valid Claim Form. 16. If I opt out, may I sue Defendant for the Data Incident? If you opt out, you give up any right to sue Defendant and Released Parties for the legal claims this Settlement resolves and Releases, and you will be bound by the terms of the Settlement, proceedings, orders, and judgments in the Action. You must opt out of this Action to start or continue your own lawsuit or be part of any other lawsuit against the Released Parties about the Released Claims in this Settlement. If you have a pending lawsuit, speak to your lawyer in that lawsuit immediately. Objecting to the Settlement 17. How do I tell the Court I do not like the Settlement? You may tell the Court that you do not agree with all or any part of the Settlement and/or Application for Attorneys’ Fees, Costs, and Service Awards by objecting to the Settlement. For an objection to be valid under the Settlement, it must be sent by U.S. Mail to the Clerk of Court, Class Counsel, Defendant’s Counsel, and the Settlement Administrator at the addresses below, postmarked by October 19, 2026. Questions? Go to UHDataSettlement.com or call 1-877-417-7187 toll-free. 7 AM9568 v.02 Clerk of the Court Class Counsel Clerk of the Court Robert M. Hatch First Judicial Circuit Court of Hawai‘i Margery S. Bronster Ka‘ahumanu Hale Bronster Fujichaku Robbins 777 Punchbowl Street 1003 Bishop Street, Suite 2300 Honolulu, HI 96813-5093 Honolulu, HI 96813 Caroline Herter Kopelowitz Ostrow, P.A. 1 W Las Olas Blvd., Suite 500 Fort Lauderdale, FL 33301 Defendant’s Counsel Settlement Administrator Alfred J. Saikali University of Hawai‘i Data Incident Shook, Hardy & Bacon L.L.P. Settlement Administrator 201 S. Biscayne Blvd., Suite 3200 P.O. Box 3719 Miami, FL 33131 Portland, OR 97208-3719 To file an objection, you cannot exclude yourself from the Settlement Class. For an objection to be considered by the Court, your objection must be written and must include the following information: 1) The objector’s full name, mailing address, telephone number, and email address (if any) 2) The case name and number: In re University of Hawaiʻi Data Breach Litigation, Civil No. 1CCV-26-0000280 (1st. Cir. Ct. of Hawai‘i) 3) All grounds for the objection, accompanied by any legal support for the objection known to you as the objector or your own lawyer 4) The number of times you have objected to a class action settlement within the five years preceding the date that you file the objection, the caption of each case in which you have made such objection, and a copy of any orders related to or ruling upon your prior objections that were issued by the trial and appellate courts in each listed case 5) The identity of all lawyers (if any) representing you in connection with the objection, including any former or current lawyers who may be entitled to compensation for any reason related to the objection to the Settlement and/or Application for Attorneys’ Fees, Costs, and Service Awards and whether they will appear at the Final Approval Hearing 6) The number of times your lawyer or your lawyer’s law firm have objected to a class action settlement within the five years preceding the date of the filed objection, the caption of each case in which your lawyer or the firm has made such objection and a copy of any orders related to or ruling upon your lawyer’s or the lawyer’s law firm’s prior objections that were issued by the trial and appellate courts in each listed case 7) A list of all persons who will be called to testify at the Final Approval Hearing in support of your objection (if any) 8) Whether you and/or your lawyer will appear and/or testify at the Final Approval Hearing 9) Your signature as the objector (a lawyer’s signature is not sufficient) Class Counsel and/or Defendant’s Counsel may conduct limited discovery on any objector or objector’s counsel, including the taking of depositions and propounding document requests. 18. What is the difference between objecting and asking to be excluded? Objecting is simply telling the Court that you do not like the Settlement or parts of it and why you do not think it should be approved. You can object only if you are a Settlement Class Member. Opting out is telling the Court that you do not want to receive any benefit from the Settlement. If you opt out, you will have no basis to object because you will no longer be part of the Settlement Class and the case will no longer affect you. Questions? Go to UHDataSettlement.com or call 1-877-417-7187 toll-free. 8 AM9569 v.02 The Lawyers Representing You 19. Do I have a lawyer in the lawsuit? Yes. The Court has appointed Robert M. Hatch and Margery S. Bronster of Bronster Fujichaku Robbins and Caroline Herter of Kopelowitz Ostrow, P.A., as Class Counsel to represent you and the Settlement Class for the purposes of this Settlement. You may hire your own lawyer at your own cost if you want someone other than Class Counsel to represent you in this lawsuit. 20. How will Class Counsel be paid? Class Counsel will file an Application for Attorneys’ Fees, Costs, and Service Awards for an award of up to one-third ($1,166,666.67) of the Settlement Fund, plus reimbursement of any costs. Any such award would compensate Class Counsel for investigating the facts, litigating the case, and negotiating the Settlement and will be the only payment to them for their efforts in achieving this Settlement and for their risk in undertaking this representation on a wholly contingent basis. Class Counsel will also ask the Court to approve up to $2,000.00 Service Awards for each of the Class Representatives for their efforts. If awarded by the Court, the attorneys’ fees and costs and the Service Awards will be paid from the Settlement Fund. The Court may award less than the amounts requested. The Court’s Final Approval Hearing 21. When and where will the Court decide whether to approve the Settlement? The Court will hold a Final Approval Hearing on November 4, 2026, at 9:00 a.m. before the Honorable Steven Nichols at the First Judicial Circuit Court for the State of Hawaiʻi, Kaʻahumanu Hale, 777 Punchbowl Street, Honolulu, HI 96813-5093. At this hearing, the Court will consider whether the Settlement is fair, reasonable, and adequate and decide whether to finally approve the Settlement and the Application for Attorneys’ Fees, Costs, and Service Awards. Note: The date and time of the Final Approval Hearing are subject to change without further notice to the Settlement Class. The Court may also decide to hold the hearing via videoconference or by telephone. You should check the Settlement Website, UHDataSettlement.com, to confirm the date and time of the Final Approval Hearing have not changed. 22. Do I have to attend the Final Approval Hearing? No. Class Counsel will answer any questions the Court may have. However, you are welcome to attend at your own expense. If you file an objection, you do not have to attend the Final Approval Hearing to speak about it. As long as you file your written objection by the deadline, the Court will consider it. 23. May I speak at the Final Approval Hearing? You may ask the Court for permission to speak at the Final Approval Hearing. To do so, you must file an objection according to the instructions in Question 17, including all the information required. Your objection must be mailed to the Clerk of the Court, Class Counsel, Defendant’s Counsel, and the Settlement Administrator at the mailing addresses listed above, postmarked by no later than October 19, 2026. If You Do Nothing 24. What happens if I do nothing? If you do nothing, you will not receive any benefits from this Settlement. If the Settlement is granted Final Approval, you will not be able to start a lawsuit, continue with a lawsuit, or be part of any other lawsuit against Defendant or the other Released Parties based on any claim that could have been or that were brought relating to the Data Incident. Questions? Go to UHDataSettlement.com or call 1-877-417-7187 toll-free. 9 AM95610 v.02 Get More Information 25. How can I get more information about the Settlement? This Notice summarizes the Settlement. Complete details about the Settlement are provided in the Settlement Agreement. The Settlement Agreement and other related documents are available at UHDataSettlement.com. You may also receive additional information by calling 1 877-417-7187 toll-free or by writing to the following address: University of Hawai‘i Data Incident Settlement Administrator P.O. Box 3719 Portland, OR 97208-3719 PLEASE DO NOT CONTACT THE COURT, THE COURT’S CLERK OFFICE, OR DEFENDANT’S COUNSEL REGARDING THIS NOTICE. Questions? Go to UHDataSettlement.com or call 1-877-417-7187 toll-free. 10