Cencora & The Lash Group $40M Data Breach Settlement

Individuals who received notice that their personal information was involved in the Cencora or The Lash Group data security incident, may qualify to submit a claim up for up to $5,000 from a class action settlement.

Cencora Inc. and The Lash Group LLC have agreed to pay $40,000,000 to settle a class action lawsuit for alleged failures to protect personal information, which resulted in a data breach which compromised the personal and protected health information of individuals across the United States and its territories.

Who is eligible for a data breach payout?

The settlement class covers both those who were directly notified and those who discovered suspicious activity that may be tied to the breach. Class members are:

• Individuals who reside in the United States or its territories whose personal information was involved in the Cencora or The Lash Group data breach.
• Individuals who received mailed notice of the incident, or substitute notice via Cencora’s website or a media press release (“Incident Notice”).
• Individuals who were on “Inquiry Notice” due to circumstances occurring between Sept. 1, 2023, and Aug. 5, 2025, that suggest awareness of damage arising from unauthorized use of their personal information that can possibly be traced back to the data breach.

How much is the class action settlement payment?

Class members can claim one of of the following:

• Documented Loss Payment: Claimants can submit to receive up to $5,000 for documented, unreimbursed expenses or losses related to the incident.
• The total pool for these payments is capped at $5,000,000. If the total approved claims exceed this cap, payments will be reduced on a pro rata basis.

• Cash Fund Payment: Class members that do not submit a documented loss claim can submit to receive a pro rata cash payment. Final payment amount will be determined by the number of approved claims filed.
• Class members residing in California who submit an approved cash fund payment claim will receive twice the amount paid to non-California class members.

How to claim a data breach class action rebate

To claim a settlement payment, class members must file a claim by the deadline of Jan. 19, 2026. Individuals can submit an online claim form or download and print the PDF claim form to mail to the settlement administrator.

Settlement administrator's mailing address: Cencora Data Security Incident Settlement Administrator c/o Kroll Settlement Administration LLC P.O. Box 225391 New York, NY 10150-5391

Required proof and claim information

• Class Member ID from official settlement notice required to submit an online claim form.
• Claimants mailing a paper claim form without a Class Member ID must provide documentation showing one or more of the following:
• A copy of the notice of data security incident they received by mail or substitute notice
• A document showing they were enrolled in, inquired about or were provided information regarding a patient support program through The Lash Group on behalf of the drug companies listed in the settlement agreement.

• Documented loss claims require losses or expenses related to the data breach. Acceptable documentation includes credit card statements, bank statements, insurance statements, invoices, telephone records, screenshots, and receipts.

Payout options

Claimants can select from the following payment options:

• PayPal
• Venmo
• Zelle
• Paper check mailed to address provided

$40 Million Cencora & The Lash Group settlement fund

The settlement fund of $40,000,000 will include:

• Settlement administration costs: To be determined
• Attorneys' fees: Up to $13,333,333.33
• Attorneys' expenses: Up to $300,000
• Service awards to class representatives: Up to $1,500 each for 28 representatives
• Payments to approved documented loss claimants: Up to $5,000,000
• Payments to approved cash fund payment claimants: Remaining settlement funds

Important dates

• Deadline to file a claim: Jan. 19, 2026
• Exclusion (opt-out) deadline: Dec. 18, 2025
• Final approval hearing: Feb. 5, 2026

When is the Cencora data breach class action settlement payout date?

Payments to approved claimants will be issued approximately 75 days after the court grants the settlement final approval, or when claim processing is complete, whichever date is later.

Why did this class action settlement happen?

The class action lawsuit alleged that Cencora and The Lash Group failed to adequately protect personal information, resulting in a data breach. Plaintiffs claimed they suffered harm as a result.

Cencora denied these allegations but agreed to settle to avoid the uncertainty and expense of continued litigation.

Sources

1. Class notice
2. Settlement website FAQ page