If you recently received a letter from Cencora (formerly known as AmerisourceBergen) or its subsidiary The Lash Group, you may be entitled to benefits from a $40 million settlement. This settlement is related to a significant data security incident that exposed personal information of potentially millions of individuals across the United States.
Many affected individuals are unsure whether this settlement applies to them, how much compensation they may receive, and what steps are required to secure a payout. This comprehensive guide breaks down everything you need to know about the Cencora Data Security Incident Settlement, including eligibility, claim options, payout types, deadlines, and how to protect your rights.
Overview of the Cencora Data Security Incident
On February 27, 2024, Cencora, Inc. filed a Form 8-K with the U.S. Securities and Exchange Commission, revealing that its data systems had been accessed by unauthorized third parties. This incident exposed sensitive personal information belonging to individuals who interacted with Cencora, its subsidiaries, or affiliated companies, including The Lash Group.
An investigation revealed that personal information was compromised between September 1, 2023, and August 5, 2025. Following the breach, Cencora began sending letters to affected individuals, as required by law, notifying them of the incident and providing steps for protection.
This breach exposed information that could be used in identity theft, fraud, or other malicious activities. The settlement, therefore, aims to compensate victims and strengthen Cencora’s future cybersecurity efforts.
What Personal Information Was Exposed
The data security incident potentially compromised a wide range of sensitive personal information, including:
- Full names
- Addresses
- Dates of birth
- Social Security Numbers
- Health and insurance information
- Financial account details
- Payment information
- Contact information
- Transaction history
- Passport information
- Driver’s license numbers
- Biometric data (e.g., fingerprints)
- Criminal history
- Employment details
- Genetic information
Because the breach involved such sensitive categories of data, victims face increased risks of identity theft, fraudulent financial activity, and unauthorized use of health or insurance records.
Details of the Settlement
A class action lawsuit was filed against Cencora and The Lash Group for failing to adequately protect consumer data. To resolve the claims, Cencora agreed to a $40 million settlement fund.
This settlement provides compensation for:
- Reimbursement of documented losses directly linked to the breach.
- Cash fund payments for all affected individuals, regardless of whether they experienced specific financial harm.
- Enhanced data security measures to reduce the likelihood of future breaches.
The settlement is open to all U.S. residents whose personal information was impacted by the incident and who received notification via mail, website posting, or media release.
Who is Eligible to File a Claim
You may be eligible if:
- You received a notice from Cencora about the data security incident.
- Your personal information was exposed during the breach.
- You are a U.S. resident.
Exclusions:
- Cencora executives and officers.
- The judges overseeing the case.
- Immediate relatives of excluded individuals.
If you received a letter containing a claim number, that is the strongest indicator of eligibility. However, even if you did not receive a letter, you may still qualify if your information was included in the affected data systems.
How to File a Claim
Filing a claim is the only way to receive benefits from the settlement. You can submit a claim in two ways:
- Online Submission:
- Visit the official claim website: Cencora Incident Settlement
- Complete the online claim form.
- Provide your claim number if you received one.
- Mail Submission:
- Download and print the claim form from the settlement website.
- Fill it out completely and attach supporting documents if applicable.
- Mail it to the address provided on the form.
Types of Settlement Benefits
The settlement offers two main types of benefits:
1. Documented Loss Payments
- Covers unreimbursed expenses directly caused by the breach.
- Examples include fraudulent charges, bank fees, credit monitoring costs, or other losses tied to identity theft.
- Maximum claim: up to $5,000 per individual.
- Proof of loss required.
2. Cash Fund Payments
- Available to all affected individuals, even if no financial loss occurred.
- Does not require documentation.
- The exact amount depends on the number of valid claims submitted and total available funds after administrative costs.
Important Note: If you submit a documented loss claim that is incomplete, your claim may automatically be converted to a cash fund claim, ensuring you still receive some compensation.
Important Deadlines
Mark these critical dates:
- Exclusion/Objection Deadline: December 18, 2025
- Claim Submission Deadline: January 19, 2026
- Final Approval Hearing: February 5, 2026, at 10:30 AM ET
Missing these deadlines may result in losing your right to compensation.
Legal Rights and Options
As a class member, you have several legal options:
- Submit a Claim
- Ensures you receive benefits.
- Gives up your right to sue Cencora separately.
- Exclude Yourself
- Retains your right to sue Cencora individually.
- Forfeits your right to settlement benefits.
- Must be postmarked by December 18, 2025.
- Object to the Settlement
- Allows you to express concerns to the court.
- You may still file a claim while objecting.
- Must be postmarked by December 18, 2025.
- Do Nothing
- You will not receive benefits.
- You will give up your right to sue separately.
How Much You Could Receive
The amount you receive depends on your claim type:
- Documented Loss Payments: Up to $5,000 with proof.
- Cash Fund Payments: Varies depending on the number of approved claims.
Because the settlement fund is capped at $40 million, payouts will be distributed proportionally after deducting legal fees, administrative costs, and service awards.
Why This Settlement Matters
This settlement highlights growing concerns over corporate responsibility in protecting sensitive personal data. As healthcare and financial institutions increasingly rely on digital systems, breaches like Cencora’s expose individuals to long-term risks.
By pursuing accountability, this settlement:
- Provides direct compensation to victims.
- Forces companies to adopt stricter security measures.
- Raises awareness of the importance of data privacy protections.
Cencora’s Response and Future Data Security Measures
In addition to the $40 million fund, Cencora has committed to:
- Enhancing encryption and network monitoring systems.
- Implementing multi-factor authentication across sensitive databases.
- Providing ongoing employee training on cybersecurity practices.
- Conducting regular third-party security audits.
These measures aim to prevent similar incidents in the future and restore public trust.
Frequently Asked Questions
1. Is the settlement legitimate?
Yes. It has been authorized by the U.S. District Court for the Eastern District of Pennsylvania.
2. Do I need a lawyer to file a claim?
No. Filing is free, and you do not need an attorney to participate.
3. What if I lost money but cannot prove it?
You may still qualify for a cash fund payment.
4. When will I receive payment?
Payments will be distributed after the Final Approval Hearing in February 2026, assuming no appeals delay the process.
5. Can I attend the final hearing?
Yes. You may attend the hearing on February 5, 2026, at 10:30 AM ET. Attendance is not required to receive benefits.
Final Thoughts
The Cencora Data Security Incident Settlement is one of the largest recent settlements involving healthcare and financial data breaches. With $40 million available, affected individuals have a real opportunity to receive compensation and closure.
If you received a letter or believe your personal information was compromised, take action before the deadlines. Submitting a claim is the only way to ensure you receive your share of the settlement.
By holding corporations accountable and demanding stronger data protections, individuals can help shape a future where personal information is treated with the highest level of security.
