The PMC Settlement is a $5.275 million class action resolving claims against PharMerica Corporation over a March 2023 data breach that exposed personal and medical information belonging to roughly 5.8 million people. If you received a breach notice from PharMerica, you can file a claim at PMCSettlement.com for a cash payment, reimbursement of up to $10,000 for documented losses, and one year of free credit monitoring. The deadline to file is April 27, 2026.
Who Qualifies
The settlement class covers all living people in the United States who received notice from PharMerica that their information was involved in the breach. Directors and officers of the company, government entities, and the presiding judge and court staff are excluded.
PharMerica identified 5,815,591 affected individuals. The exposed data included names, addresses, dates of birth, Social Security numbers, medication lists, and health insurance information. PharMerica denies any wrongdoing; the payment is a compromise, not a finding of liability.
What You Can Get
Three benefits are available. You can claim more than one.
Reimbursement of documented losses, up to $10,000. Called Cash Payment A, this covers out-of-pocket expenses you can trace to the breach: unreimbursed fraud or identity theft losses, professional fees, credit freeze costs, and related expenses. You have to submit documentation. This money comes from a separate claims-made fund paid by PharMerica, not from the $5.275 million common fund.
A flat pro rata cash payment. Called Cash Payment B, this is an equal share of what’s left in the settlement fund after administration costs, attorneys’ fees, and service awards are deducted. Every class member who files a valid claim receives the same amount, and the amount depends on how many people file.
One year of credit monitoring. Kroll Complete Monitoring is provided automatically to every class member. You do not need to file a claim form to get it. The service includes credit monitoring, dark web monitoring, payday loan monitoring, Social Security number scans, fraud consultation, identity theft restoration, and $1 million in identity theft insurance with no deductible.
How To File a Claim
File online at PMCSettlement.com or mail a completed claim form to Kroll Settlement Administration LLC, P.O. Box 225391, New York, NY 10150-5391. To file online you need the class member ID printed on the notice PharMerica mailed you.
If you’re claiming documented losses under Cash Payment A, keep your receipts, statements, and any correspondence showing the expense and its connection to the breach. Claims without documentation can still qualify for the flat pro rata payment.
Questions can go to the settlement administrator at (833) 754-6609 or through the settlement website.
Key Dates
- April 13, 2026: deadline to opt out or file an objection (postmark).
- April 27, 2026: deadline to submit a claim.
- May 12, 2026, 1:00 p.m. ET: final approval hearing before Judge Rebecca Grady Jennings at the federal courthouse in Louisville, Kentucky.
The court granted preliminary approval on January 12, 2026. Payments cannot go out until the court grants final approval and any appeals are resolved.
Opting Out or Objecting
If you don’t want to be bound by the settlement, mail a signed exclusion request postmarked by April 13, 2026. Opting out preserves your right to sue PharMerica separately but forfeits any payment from this settlement.
If you want to stay in the class but tell the court you disagree with the terms, mail a written objection postmarked by April 13, 2026, to the court clerk, class counsel, PharMerica’s counsel, and the settlement administrator.
Why the Settlement Exists
PharMerica is one of the largest pharmacy companies in the United States and serves long-term care facilities, senior living communities, hospice programs, and hospitals. It is a subsidiary of BrightSpring Health Services.
On March 14, 2023, PharMerica and BrightSpring detected suspicious activity on their network. A forensic investigation found that an unauthorized third party had accessed PharMerica’s systems on March 12 and 13, 2023. A ransomware group called Money Message claimed responsibility on March 28, 2023, said it had exfiltrated 4.7 terabytes of data, and began posting stolen patient information on its dark web leak site.
Multiple lawsuits followed. On July 19, 2023, the U.S. District Court for the Western District of Kentucky consolidated four cases into In Re: PharMerica Data Breach Litigation, lead case Lurry v. PharMerica Corporation, No. 3:23-cv-00297-RGJ. The plaintiffs alleged PharMerica failed to use reasonable cybersecurity measures. Federal health privacy law does not allow individuals to sue directly, so the case ran on state-law theories including negligence, breach of contract, and consumer protection claims. After a June 2024 ruling that allowed five of the plaintiffs’ claims to proceed and formal mediation in August 2025, the parties reached the settlement now before the court.
As part of the deal, PharMerica also agreed to security improvements to its systems valued at roughly $2.54 million annually, though the specific measures were not detailed in the court filings.