Cencora Data Breach Settlement: $40M

Individuals whose personal information was involved in the Cencora data breach and who received either a:

• Mailed notice of the incident,
• Substitute notice via Cencora’s website or media press release, or who
• Experienced signs of misuse tied to the breach (such as fraud alerts, unfamiliar benefit statements, or suspicious financial activity).

For documented loss claims: bank statements, insurance records, credit reports, invoices, receipts, or screenshots showing breach-related impact.

For general cash claims, no proof is required.

Cencora has agreed to a $40 million class action settlement to resolve allegations stemming from a February 2024 cyberattack that exposed the private health and personal information of over 540,000 individuals.

The breach reportedly impacted names, birthdates, diagnoses, prescriptions, insurance data, and financial details. Affected individuals were notified by mail or through public disclosures.

The settlement follows a class action lawsuit filed by plaintiff Kelvin James in Pennsylvania federal court, alleging that Cencora and its subsidiary The Lash Group failed to adequately secure their systems. According to the complaint, the companies waited more than three months to notify customers about the breach, increasing the risk of identity theft and fraud.

James, a patient of the companies, claims the attack resulted in suspicious account activity and damage to his credit. The lawsuit accuses the companies of negligence and breach of implied contract.

While Cencora denies any wrongdoing, it agreed to the settlement to resolve the claims.

What Class Members Can Receive

Class members may be eligible for up to $5,000 in documented loss reimbursement for expenses such as fraud-related charges, credit monitoring, or professional services.

Those without documentation may still receive a cash payment from the remaining settlement funds. California residents may qualify for double the amount due to statutory provisions.