The Cencora data breach settlement payout will come from a $40 million non-reversionary fund, but the exact per-person amount won’t be known until Kroll Settlement Administration finishes processing claims. Payments are expected to start in July 2026. What you receive depends on which of two claim options you chose and how many people filed valid claims by the January 19, 2026 deadline.
The Two Payment Options
Claimants had to pick one of two mutually exclusive options, and that choice controls the size of the check.
The cash fund payment required no documentation. Everyone who selected it gets an equal share of whatever is left in the $40 million fund after attorneys’ fees, administrative costs, service awards, and documented-loss payments are subtracted. Kroll has said it received a “large volume of claims” but has not released a count.
The documented loss payment pays up to $5,000 per claimant for out-of-pocket expenses tied to the breach, supported by bank statements, invoices, credit card records, or receipts. A separate $5 million pool funds these payments. If approved documented-loss claims exceed $5 million in total, every payment in that pool is reduced proportionally.
California residents may receive double the amount awarded to non-California claimants, based on state statutory damages provisions.
What the Cash Payment Is Likely to Be
Data breach class actions typically produce modest payouts for undocumented claims. Comparable cases have ranged widely: the T-Mobile breach settlement paid between $25 and $25,000 depending on documented harm, and the Equifax consumer fund worked out to a few dollars per person for those without documented losses. Industry benchmarks put typical undocumented payouts somewhere in the $25 to $100 range, though the actual figure turns entirely on the claim rate.
The math starts with $40 million and shrinks from there. Attorneys’ fees can reach $13,333,333.33, plus up to $300,000 in attorney expenses. Service awards to the 28 named plaintiffs total $42,000. Administration costs paid to Kroll are not publicly disclosed. Roughly $25 to $26 million is likely to remain for class members, and documented-loss claims are paid from that before the cash-fund pool is divided.
The claim rate does the rest. If 500,000 people filed cash-fund claims, each share might land near $50. If only 100,000 filed, shares could reach several hundred dollars. Kroll has not released participation figures.
When Payments Will Arrive
Kroll Settlement Administration LLC expects to begin distributing payments in July 2026, following the court’s final approval on April 28, 2026. The settlement website has not confirmed whether payments will be sent by check, electronic transfer, or both.
If you filed a claim and have since moved or changed contact information, notify the administrator by mail or by calling (833) 621-8029. A payment that can’t be delivered because of outdated contact details won’t reach you on its own.
Who Qualifies for a Payment
The settlement class covers U.S. residents whose personal information was involved in the breach and who either received a mailed or substitute notice from Cencora or were on “Inquiry Notice” between September 1, 2023, and August 5, 2025. Inquiry Notice covers people who saw suspicious activity — unexpected explanation-of-benefits letters, bank fraud alerts — that would lead a reasonable person to suspect their data had been compromised. Current and former Cencora employees are included. Cencora executives, board members, the judge and her staff, and anyone who opted out by December 18, 2025 are excluded.
If You Missed the Claims Deadline
The claim deadline passed on January 19, 2026, and final approval was granted in April. New claims can no longer be filed. Anyone who was a class member, did not opt out, and did not file a claim is still bound by the settlement’s release of claims but will not receive a payment.
What Cencora Agreed to Beyond the Cash
The $40 million fund is non-reversionary, so Cencora cannot recover unused money. Separately, the settlement requires Cencora to implement enhanced data security measures at its own expense. The agreement references these improvements but does not publicly detail the specific technical changes. Cencora agreed to the settlement without admitting wrongdoing or liability.