Cencora & The Lash Group reach $40M settlement in data breach class action

Cencora & The Lash Group reach $40M settlement in data breach class action

Consumers who received notice that their personal information was involved in the Cencora data security incident or believe their information was affected may be eligible to claim up to $5,000 or a cash payment from a class action settlement .

Cencora Inc. agreed to pay $40 million to resolve a class action lawsuit alleging it failed to adequately protect sensitive personal information that was compromised during a data breach disclosed in February 2024 .

The settlement also covers claims against The Lash Group LLC , a Cencora affiliate.

Who is eligible for a payout?

According to the settlement agreement, eligible class members include anyone in the United States and its territories (Puerto Rico, U.S. Virgin Islands, American Samoa, Guam and Northern Mariana Islands) whose personal information was involved in the Cencora data security incident and who either:

• Received a mailed notice of the incident or substitute notice via Cencora’s website or a media press release or
• Were on “inquiry notice” due to circumstances occurring on or after Sept. 1, 2023, through the date of preliminary approval, suggesting they were aware of harm potentially arising from unauthorized use of their personal information (for example, receiving an unexpected explanation of benefits statement or a fraud alert from a bank that, upon inquiry, could be traced to the incident)

Personal information that may have been compromised includes but is not limited to:

• Health and insurance information
• Financial account details, compensation and payment information
• Transactional and consumer profile data
• Racial or ethnic identity
• Sexual orientation or identity
• IP addresses or other electronic identifiers
• Biometric or genetic information
• Driver’s license and passport information

How much can class members get?

Class members can claim one of two types of cash settlement benefits but not both.

Documented loss payments

Class members who have documented, unreimbursed losses or expenses related to the data breach can claim up to $5,000 per person. To qualify, they must provide reasonable documentation of losses or expenses incurred on or after Sept. 1, 2023, and up to the claims deadline.

The documented loss payments fund has a total cap of $5 million for all payments. If the total approved documented loss claims exceed $5 million, each payment will be reduced proportionally (pro rata). For example, if class members submit $10 million in valid claims, each claimant would receive 50% of their approved amount ($5,000,000 ÷ $10,000,000 = 50%).

Cash fund payments

Class members who do not have documented loss can claim a cash payment with no documentation required. The amount depends on the number of approved claims and the remaining settlement fund after other payments are made.

California class members who submit approved claims for a cash fund payment will receive twice the amount paid to non-California class members to account for statutory damages under California law.

For example, if the net fund available for cash payments is $20 million and there are 100,000 approved claims (10,000 from California), the calculation would allocate two shares per California claimant and one per non-California claimant. The total number of shares would be 110,000 (10,000 x 2 + 90,000 x 1). Each share would be worth $181.82 ($20,000,000 ÷ 110,000). California claimants would receive $363.64, and non-California claimants would receive $181.82.

How to submit a claim for a payout

To claim a payout, class members must submit a claim form either online or by mail. The online and PDF claim forms will be accessible at the official settlement website, cencoraincidentsettlement.com, when the site goes live.