The Cencora data breach settlement is a $40 million class action resolution covering people whose personal and health information was exposed in the February 2024 cyberattack on Cencora, Inc. and its subsidiary The Lash Group. A federal judge in the Eastern District of Pennsylvania granted final approval on April 28, 2026, and the settlement administrator expects to begin sending payments in July 2026.1CencoraIncidentSettlement.com. Cencora/The Lash Group Data Security Incident Settlement
The claim filing deadline was January 19, 2026, and has passed. New claims are no longer being accepted. If you already filed, the sections below explain what you can expect and how to check your status.2CencoraIncidentSettlement.com. Cencora Data Security Incident Settlement FAQ
Who Was Covered by the Settlement
The class covers U.S. residents whose personal information was involved in the breach and who either received a direct notice from The Lash Group or were on “inquiry notice,” meaning they experienced circumstances after September 1, 2023, that suggested unauthorized use of their data traceable to the incident.3BusinessWire. Kroll Settlement Administration Announces Settlement Regarding a Data Security Incident
The clearest indicator of eligibility was a notification letter from the settlement administrator, Kroll Settlement Administration LLC, that included a specific claim number.4Delaware Online. Lash Group Cencora Settlement Payout5HIPAA Journal. Cencora Cyberattack Data Breach6Telehealth.org. Cencora
What Claimants Can Receive
The $40 million fund pays two types of claims, along with administrative costs and attorneys’ fees.
- Documented loss payments of up to $5,000 per person for unreimbursed, documented expenses fairly traceable to the breach. Qualifying costs include fraudulent charges, bank fees, credit monitoring, and other identity-theft-related losses incurred between September 1, 2023, and January 19, 2026. This category is capped at $5 million total, and if valid claims exceed that cap, payments are reduced pro rata.4Delaware Online. Lash Group Cencora Settlement Payout
- Cash fund payments for class members who did not submit documentation of specific losses. The per-person amount is not fixed. It depends on how many approved claims are filed and how much is left in the fund after documented losses, fees, and administrative expenses are paid.1CencoraIncidentSettlement.com. Cencora/The Lash Group Data Security Incident Settlement
Cencora also agreed to implement enhanced data and information security measures as part of the settlement.1CencoraIncidentSettlement.com. Cencora/The Lash Group Data Security Incident Settlement Separately, the company had already offered affected individuals 24 months of credit monitoring through Experian’s IdentityWorks program.7Cencora. CareDx Notice
When Payments Are Expected
Judge Cynthia M. Rufe issued final approval on April 28, 2026. Because of the volume of claims submitted, Kroll is still processing claim forms and anticipates starting to distribute payments in July 2026. The settlement website advises claimants to keep checking for updates rather than expecting a fixed payment date.1CencoraIncidentSettlement.com. Cencora/The Lash Group Data Security Incident Settlement
How to Check Your Claim Status
Kroll is the court-approved administrator responsible for reviewing claims, contacting claimants about any deficiencies, and calculating final payment amounts. You can check the status of a submitted claim at cencoraincidentsettlement.com or by calling 833-621-8029.2CencoraIncidentSettlement.com. Cencora Data Security Incident Settlement FAQ
What Happened in the Breach
Cencora disclosed on February 21, 2024, in a filing with the U.S. Securities and Exchange Commission that data had been exfiltrated from its information systems.5HIPAA Journal. Cencora Cyberattack Data Breach By May 2024, the company confirmed that the stolen information included patient names, addresses, dates of birth, health diagnoses, prescriptions, and in some cases Social Security numbers.7Cencora. CareDx Notice An updated SEC filing in July 2024 disclosed that more data had been taken than originally identified.
The consolidated class action, Anaya, et al. v. Cencora, Inc., et al., Case No. 2:24-cv-02961-CMR, alleged negligence, breach of implied contract, unjust enrichment, and related claims, and pointed to alleged violations of HIPAA’s technical safeguard requirements. Plaintiffs also argued that Cencora delayed notifying affected consumers, disclosing the breach to the SEC in February 2024 but not sending individual notices until late May.8CPM Legal. Reynolds et al. v. Cencora, Inc. and The Lash Group, LLC, Complaint Cencora and The Lash Group settled without admitting wrongdoing or liability.5HIPAA Journal. Cencora Cyberattack Data Breach