Cencora, the drug wholesaler formerly called AmerisourceBergen, disclosed a data breach in February 2024. A $40 million class settlement followed, and its claim deadline has now passed.
Payments still haven’t gone out. Here’s what the case covered, when money is expected and how to tell real settlement updates from fake ones.
Overview
What Happened at Cencora
On February 21, 2024, Cencora learned that data had been taken from its information systems, some of which could contain personal information.
It reported the incident to the SEC six days later.
The data came from The Lash Group, a Cencora affiliate that runs patient support programs for drug makers. Notices went to patients whose information was held through those programs.
What the Settlement Covers
A class action over the incident ended in a $40 million settlement with Cencora, Inc. and The Lash Group, LLC, now called Cencora Patient Services.
Class members could claim either documented losses up to $5,000 or a cash payment.
The claim deadline was January 19, 2026. Judge Cynthia M. Rufe granted final approval on February 11, 2026, and payments are expected to begin in November 2026.
Our Verdict
The Cencora data breach and its settlement are real. The claim window has closed, so new claims are no longer possible.
- The breach was disclosed in an SEC filing on February 27, 2024.
- The settlement administrator is Kroll Settlement Administration.
- Claims had to be filed online or postmarked by January 19, 2026.
- The administrator expects to begin paying approved claims in November 2026.
- The only official website is www.CencoraIncidentSettlement.com.
- Any message now offering to “file your Cencora claim” for a fee is a red flag.
Cencora Data Security Incident: What Happened
Cencora’s Form 8-K, filed under Item 1.05 for material cybersecurity incidents, says the company “learned that data from its information systems had been exfiltrated” on February 21, 2024.
The filing says Cencora took containment steps and began an investigation with law enforcement, cybersecurity experts and outside lawyers. It said operations were not materially affected.
The Lash Group later posted a substitute notice on cencora.com for people it could not reach by mail.
It says that on May 8, 2024, it confirmed personal information may have been involved.
That notice lists first name, last name, address, date of birth, Social Security number and the fact that a diagnostic test may have been performed.
It adds that not all elements applied to every person.
The notice offered 24 months of Experian IdentityWorks credit monitoring. The enrollment deadline in that notice was September 30, 2024, so that offer has expired.
The notice also says there was no evidence that the information had been publicly disclosed or misused for fraud.
Cencora Data Breach Timeline
February 21, 2024: Cencora learns that data was taken from its information systems.
February 27, 2024: Cencora reports the incident to the SEC in a Form 8-K under the item for material cybersecurity incidents.
May 8, 2024: The Lash Group confirms that personal information may have been involved, then sends notices and posts substitute notices online.
September 30, 2024: the enrollment deadline for the free Experian credit monitoring offered in the substitute notice.
September 19, 2025: Kroll Settlement Administration announces the $40 million settlement with The Lash Group.
December 18, 2025: the deadline to opt out of the settlement or object to it.
January 19, 2026: the claim deadline.
February 5, 2026: the Final Approval Hearing in Philadelphia.
February 11, 2026: Judge Rufe grants final approval and approves attorneys’ fees and service awards.
October 16, 2026: the administrator says it expects to begin payments in November 2026.
Who Was Affected by the Cencora Data Breach
The Lash Group works with pharmaceutical companies, pharmacies and healthcare providers on patient support programs, such as help with access to a prescribed therapy.
Its notice says the data was held “through its current or past partnerships” in connection with those programs.
That is why many recipients had never heard of Cencora before their letter arrived.
Notices were also filed with state regulators, including the Massachusetts and Washington attorneys general.
Court filings put the notice list at about 10.6 million people. By January 20, 2026, the administrator had received more than 688,000 claim forms.
If you are unsure whether you were included, look for a 2024 letter from The Lash Group, or from a drug maker’s patient program, that mentions Cencora.
The notice on cencora.com covers one program and mentions a diagnostic test. Washington’s Attorney General lists name, full date of birth and medical information for an Incyte program.
Cencora Data Breach Lawsuit
The class case was heard in the US District Court for the Eastern District of Pennsylvania.
Class counsel lists it as Anaya v. Cencora, No. 24-cv-2961, before Judge Cynthia M. Rufe.
The plaintiffs alleged that Cencora failed to adequately protect their personal information. Cencora denies any wrongdoing, and the settlement is not an admission that it did anything wrong.
No court ruled on the claims. The case settled before trial, and the judge dismissed it with prejudice when approving the deal.
The settlement notice says The Lash Group “has undertaken security commitments to strengthen its information security” as part of the deal.
The Final Approval Hearing took place before Judge Rufe at the US Courthouse at 601 Market Street in Philadelphia, in Courtroom 12-A.
Cencora Settlement: Who Qualified and What It Paid
The class covers people in the United States and its territories whose personal information was involved and who received mailed or substitute notice from Cencora or The Lash Group.
It also covers people on “Inquiry Notice”. These are people who saw signs of harm between September 1, 2023 and August 5, 2025 that, on inquiry, pointed to the incident.
The notice gives two examples: an unexpected explanation of benefits statement, or a fraud alert from a bank.
Each claimant could choose one cash benefit:
- Documented Loss Payment: money spent or fees incurred that were more likely than not caused by the incident, up to $5,000 per person and $5 million in total.
- Cash Fund Payment: a share of what remains in the fund after documented losses, administration costs, taxes, service awards, attorneys’ fees and costs.
A January 2026 court filing estimated cash payments at about $26, or about $52 for California class members. Final amounts depend on claims processing.
How the $40 Million Settlement Fund Is Split
The fund pays approved claims first, along with administration expenses, taxes and escrow fees.
The court awarded service awards of $1,500 to each of the 28 class representatives, or $42,000 in total.
It also awarded attorneys’ fees of $13,333,333.33, one third of the fund, plus $57,233.19 in litigation costs.
Because fees and costs come out of the same $40 million, the cash payment per person is usually far smaller than the headline figure suggests.
What Happens If You Opted Out or Did Nothing
Class members who did not ask to be excluded by December 18, 2025 are bound by the settlement.
They give up the right to sue Cencora, The Lash Group and the other released parties, including Cencora’s customers and business partners, over the incident.
In practice, that means most people who received a notice can no longer bring their own lawsuit over this breach, whether or not they filed a claim.
People who sent a valid exclusion request by December 18, 2025 kept their right to sue separately. They do not receive any payment from this settlement.
Cencora Settlement Deadlines and Status
The settlement notice from Kroll Settlement Administration set these dates:
- December 18, 2025: last day to opt out or object. This date has passed.
- January 19, 2026: last day to submit a claim online or by mail, postmarked. This date has passed.
- February 5, 2026, 10:30 a.m. ET: Final Approval Hearing before Judge Rufe in Philadelphia.
Judge Rufe granted final approval of the $40 million settlement on February 11, 2026, and overruled the only objection.
The administrator’s October 16, 2026 update says it is still processing a large volume of claims and expects to begin payments in November 2026.
Third-party claim trackers have published different payment estimates. Rely only on updates posted on www.CencoraIncidentSettlement.com.
If you missed the deadline, no website or claim service can file a late claim for you now.
Cencora Data Security Since the Breach
Cencora’s annual report for fiscal 2025 says the company and its business partners “have experienced detrimental cyberattacks”. It names incidents disclosed in February 2024 and in March 2023.
The same report says neither incident had a material adverse impact on the company, while warning that similar incidents could happen again.
For patients, the practical question is simpler. Data already taken in 2024 cannot be recalled, so the protective steps below still matter years later.
Protect Yourself After the Cencora Breach
The Lash Group notice included a reference guide with standard steps. It recommends ordering free credit reports through annualcreditreport.com and checking them for accounts you do not recognize.
It also explains fraud alerts, which warn lenders to verify your identity before opening new credit, and security freezes, which block access to your credit file.
The guide also outlines your rights under the Fair Credit Reporting Act, including the right to dispute inaccurate or unverifiable information in your credit file.
The notice says a security freeze is free. You request it from Equifax, Experian and TransUnion, and you may need to provide identification.
Because the data came from patient support programs, also read every explanation of benefits from your insurer. Report any service or prescription you did not receive.
Is the Cencora Settlement Legit?
Yes. The settlement was announced by Kroll Settlement Administration, the settlement administrator. The official site is www.CencoraIncidentSettlement.com.
The administrator’s notice pointed class members to that single website for claims, updates and questions.
What is not legit is any message today that asks you to pay a fee, share your bank login or “reopen” a Cencora claim. The claim period is over.
You can confirm the case details yourself. The case number is 24-cv-2961 in the Eastern District of Pennsylvania, and the administrator is Kroll Settlement Administration.
Fake Cencora Settlement Messages to Watch For
Well-known settlements attract copycat emails and texts. They borrow the case name and the payout figure to collect personal details or fees.
These messages often arrive around real milestones, such as final approval or payment news, when class members expect to hear something.
Warning signs include a link to a site other than the official one, or a text asking for your Social Security number.
A demand for a “processing fee” before payment is another sign. So is pressure to act within hours.
A real settlement payment never requires you to pay anything first. Share payment details only through the official site.
Type the official address into your browser yourself rather than clicking a link in a message. If in doubt, contact the administrator through the details on that site.
Some fake messages claim that your payment failed and ask you to “verify” bank details through a link.
Check payment status only on the official site or by calling (833) 621-8029. The administrator says it doesn’t communicate by text, and any callback comes from 855-711-8800.
What to Do If You Got a Cencora or Lash Group Notice
- Check whether you filed a claim. Look for a confirmation email or claim ID from before January 19, 2026, and keep it safe.
- Use only the official site. Update your contact or payment details only at www.CencoraIncidentSettlement.com.
- Ignore unexpected settlement messages. Do not click links or call numbers in texts or emails about Cencora money.
- Review your statements. Check bank, card and insurance statements, including explanations of benefits, for anything you do not recognize.
- Consider a credit freeze. If your notice listed your Social Security number, a free freeze at Equifax, Experian and TransUnion stops most new credit in your name.
- Report identity theft. If someone used your information, follow the recovery steps at IdentityTheft.gov.
- Report fake settlement messages. Forward suspicious texts to 7726 and report them at ReportFraud.ftc.gov.
How to Check Any Data Breach Settlement Notice
Search for the case name together with the word “settlement” and compare the website in your message with the one named in court filings or the administrator’s release.
Check the deadlines. A message asking you to “file now” for a settlement whose claim period has closed is not genuine.
Never pay to receive settlement money, and never give a password or one-time code to anyone who contacts you about a payout.
Keep copies of any genuine claim confirmation. A real claim ID from the administrator is the easiest way to spot a message that does not match your claim.
Related Settlement Guides
Our Allina pixel settlement guide covers another healthcare privacy settlement with eligibility rules and deadlines.
For help telling real settlement emails from fakes, see our ClearPath Payments Apple settlement guide.
The AT&T data breach settlement guide explains how another large breach settlement handled claims.
Frequently Asked Questions
What was the Cencora data breach?
On February 21, 2024, Cencora learned that data had been taken from its systems.
Data from Lash Group patient support programs was involved. Depending on the program, it included names, dates of birth, medical information and some Social Security numbers.
Is the Cencora data breach settlement real?
Yes. Kroll Settlement Administration runs it, and the official website is www.CencoraIncidentSettlement.com. Ignore any other site that claims to take Cencora claims.
Can I still file a Cencora settlement claim?
No. The claim deadline was January 19, 2026. Messages offering to file a claim for you now are not from the settlement.
How much will I get from the Cencora settlement?
Documented losses were capped at $5,000 per person. Cash payments were estimated in January 2026 at roughly $26, or $52 for California class members.
When will Cencora settlement payments be sent?
The administrator’s October 2026 update says payments should begin in November 2026. The court granted final approval on February 11, 2026.
Was Cencora data security fixed after the breach?
Under the settlement, The Lash Group agreed to security commitments to strengthen its information security. The public notice does not list the specific measures.
The Bottom Line
The Cencora data breach and its $40 million settlement are real, but the claim deadline of January 19, 2026 has passed and no new claims are possible.
If you filed in time, payments are expected to start in November 2026. Follow only www.CencoraIncidentSettlement.com and ignore any text asking for fees or bank logins.
Whether or not you filed, consider a free credit freeze, read every explanation of benefits and check your credit reports for accounts you don’t recognize.
Join the discussion
0 commentsShare your experience or ask a question about this article.
Discussion
Start the conversation
Have a question or something useful to share? Add the first comment.