Cencora and The Lash Group $40M Data Breach Settlement

Individuals who received notice that the Cencora or The Lash Group data security incident may have compromised their personal information could qualify to submit a claim up for up to $5,000 from a class action settlement.

Cencora Inc. and The Lash Group LLC agreed to pay $40,000,000 to settle a class action lawsuit alleging it failed to protect personal information, which resulted in a data breach that compromised the personal and protected health information of individuals across the United States and its territories.

Who is eligible for a data breach payout?

The settlement class includes those who received direct notification about the settlement and those who discovered suspicious activity that may be tied to the breach. Class members are:

• Individuals who reside in the United States or its territories whose personal information the Cencora or The Lash Group data breach potentially compromised.
• Individuals who received a mailed notice or substitute notice via Cencora’s website or a media press release.
• Individuals who were on “inquiry notice” due to circumstances occurring between Sept. 1, 2023, and Aug. 5, 2025, that suggest awareness of damage arising from unauthorized use of their personal information that can possibly be traced back to the data breach.

How much is the class action settlement payment?

Class members can claim one of of the following:

• Documented loss payment: Claimants can submit a claim to receive up to $5,000 for documented, unreimbursed expenses or losses related to the incident.
• The total pool for these payments is capped at $5,000,000. If the total approved claims exceed this cap, the settlement administrator will reduce payments on a pro rata basis.

• Cash fund payment: Class members who do not submit a documented loss claim can submit a claim to receive a pro rata cash payment. The settlement administrator will determine the final payment amount by the number of approved claims filed.
• Class members residing in California who submit an approved cash fund payment claim will receive twice the amount paid to non-California class members.

How to claim a data breach class action rebate

To claim a settlement payment, class members must file a claim by the deadline of Jan. 19, 2026. Individuals can submit an online claim form or download and print the PDF claim form, fill it out and mail to the settlement administrator.

Settlement administrator's mailing address: Cencora Data Security Incident Settlement Administrator, c/o Kroll Settlement Administration LLC, P.O. Box 225391 New York, NY 10150-5391

Required proof and claim information

• To submit an online claim form, class members must provide the class member ID from their official settlement notice.
• Claimants mailing a paper claim form without a class member ID must provide documentation showing one or more of the following:
• A copy of the notice of data security incident they received by mail or substitute notice
• A document showing they were enrolled in, inquired about or received information regarding a patient support program through The Lash Group on behalf of the drug companies listed in the settlement agreement

• Documented loss claims require losses or expenses related to the data breach. Acceptable documentation includes credit card statements, bank statements, insurance statements, invoices, telephone records, screenshots and receipts.

Payout options

Claimants can select from the following payment options:

• PayPal
• Venmo
• Zelle
• Paper check mailed to address provided

$40 million Cencora/The Lash Group settlement fund

The settlement fund of $40,000,000 will include:

• Settlement administration costs: To be determined
• Attorneys' fees: Up to $13,333,333.33
• Attorneys' expenses: Up to $300,000
• Service awards to class representatives: Up to $1,500 each for 28 representatives
• Payments to approved documented loss claimants: Up to $5,000,000
• Payments to approved cash fund payment claimants: Remaining settlement funds

Important dates

• Exclusion (opt-out) deadline: Dec. 18, 2025
• Deadline to file a claim: Jan. 19, 2026
• Final approval hearing: Feb. 5, 2026

When is the Cencora data breach class action settlement payout date?

The settlement administrator will issue payments to approved claimants approximately 75 days after the court grants the settlement final approval or when claim processing is complete, whichever date is later.

Why did this class action settlement happen?

The class action lawsuit alleged Cencora and The Lash Group failed to adequately protect personal information, resulting in a data breach. The plaintiffs claimed they suffered harm as a result.

Cencora denied these allegations but agreed to settle to avoid the uncertainty and expense of continued litigation.

Sources

1. Class notice
2. Settlement website FAQ page