Cencora & The Lash Group reach $40M settlement in data breach class action

Cencora Inc.

Consumers who received notice that their personal information was involved in the Cencora data security incident or believe their information was affected may be eligible to claim up to $5,000 or a cash payment from a class action settlement.

Cencora Inc. agreed to pay $40 million to resolve a class action lawsuit alleging it failed to adequately protect sensitive personal information that was compromised during a data breach disclosed in February 2024.

The settlement also covers claims against The Lash Group LLC, a Cencora affiliate.

Who is eligible for a payout?

According to the settlement agreement, eligible class members include anyone in the United States and its territories (Puerto Rico, U.S. Virgin Islands, American Samoa, Guam and Northern Mariana Islands) whose personal information was involved in the Cencora data security incident and who either:

Received a mailed notice of the incident or substitute notice via Cencora’s website or a media press release or
Were on “inquiry notice” due to circumstances occurring on or after Sept. 1, 2023, through the date of preliminary approval, suggesting they were aware of harm potentially arising from unauthorized use of their personal information (for example, receiving an unexpected explanation of benefits statement or a fraud alert from a bank that, upon inquiry, could be traced to the incident)

Personal information that may have been compromised includes but is not limited to:

Names
Addresses
Dates of birth
Social Security numbers
Health and insurance information
Financial account details, compensation and payment information
Transactional and consumer profile data
Racial or ethnic identity
Political opinions
Sexual orientation or identity
Criminal history
IP addresses or other electronic identifiers
Biometric or genetic information
Trade union membership
Driver’s license and passport information

How much can class members get?

Class members can claim one of two types of cash settlement benefits but not both.

Documented loss payments

Class members who have documented, unreimbursed losses or expenses related to the data breach can claim up to $5,000 per person. To qualify, they must provide reasonable documentation of losses or expenses incurred on or after Sept. 1, 2023, and up to the claims deadline.

The documented loss payments fund has a total cap of $5 million for all payments. If the total approved documented loss claims exceed $5 million, each payment will be reduced proportionally (pro rata). For example, if class members submit $10 million in valid claims, each claimant would receive 50% of their approved amount ($5,000,000 ÷ $10,000,000 = 50%).

Cash fund payments

Class members who do not have documented loss can claim a cash payment with no documentation required. The amount depends on the number of approved claims and the remaining settlement fund after other payments are made.

California class members who submit approved claims for a cash fund payment will receive twice the amount paid to non-California class members to account for statutory damages under California law.

For example, if the net fund available for cash payments is $20 million and there are 100,000 approved claims (10,000 from California), the calculation would allocate two shares per California claimant and one per non-California claimant. The total number of shares would be 110,000 (10,000 x 2 + 90,000 x 1). Each share would be worth $181.82 ($20,000,000 ÷ 110,000). California claimants would receive $363.64, and non-California claimants would receive $181.82.

How to submit a claim for a payout

To claim a payout, class members must submit a claim form either online or by mail. The online and PDF claim forms will be accessible at the official settlement website, cencoraincidentsettlement.com, when the site goes live.

Settlement administrator's mailing address: Cencora Data Security Incident Settlement Administrator c/o Kroll Settlement Administration LLC, P.O. Box 225391, New York, NY, 10150-5391

If a class member's contact information changes after submitting a claim, they must notify the settlement administrator to ensure they receive payment.

What proof or documentation is needed to submit a claim?

For documented loss payments, claimants must provide reasonable documentation of losses or expenses, which includes but is not limited to credit card statements, bank statements, insurance statements, invoices, telephone records, screen shots and receipts.

For cash fund payments, class members who do not need to provide documentation if they have a unique notice ID; otherwise, they must provide a signed certification attesting eligibility.

Claim instructions

To submit a claim, follow these steps:

Obtain a claim form from the official settlement website (when it goes live) or by contacting the settlement administrator.
Complete the form with the class member's name, contact information and unique notice ID (if available).
Select either the documented loss payment or cash fund payment option.
If claiming a documented loss payment, attach all supporting documentation for your losses or expenses.
Sign and date the form (and certification, if required).
Submit the form online or mail it to the settlement administrator at the address above.
The settlement administrator will notify claimants if their claim is incomplete or defective so they can correct it.

What are the payout methods?

Class members can choose from several payment options:

PayPal (email address associated with the PayPal account required)
Venmo (mobile number associated with the Venmo account required)
Zelle (mobile number associated with the Zelle account required)
Physical check mailed to an address

$40 million settlement fund

The $40,000,000 settlement fund will cover all payments to class members, attorneys’ fees and costs, service awards to class representatives, taxes, escrow fees and administrative expenses.

Fund distribution:

Attorneys’ fees: $13,333,333.33 (up to 33.3% of the fund)
Attorneys’ expenses: Up to $300,000
Service awards to class representatives: $42,000 (up to $1,500 each for 28 representatives)
Settlement administration costs, escrow fees and taxes: TBD
Payments to class members: Remaining balance after above deductions

Payments for documented losses: Up to $5 million total
Cash payments: Remaining balance (pro rata)

Important dates

Preliminary approval order: TBD
Notice date: No later than 60 days after the preliminary approval order
Deadline to file a claim: 120 days after the notice date
Final approval hearing date: No earlier than 230 days after the preliminary approval order

When is the Cencora data security incident settlement payout date?

Payments will be made within 45 days after the effective date, which is the first business day after court grants final approval of the settlement and any appeals are resolved. This process may take several months after the final approval hearing.

In the best case scenario, if no appeals are filed, it will take approximately 306-311 days from the preliminary approval order to payments beginning:

```

Event	Timeline	Day Count
Preliminary Approval Order	Day 0	Day 0
Settlement Fund Initial Payment	Within 20 days	Day 20
Notice Date (mailings begin)	Within 60 days	Day 60
Objection/Exclusion Deadline	90 days after Notice	Day 150
Claims Deadline	120 days after Notice	Day 180
Final Approval Hearing	No earlier than 230 days	Day 230
Final Approval Order Entered	At/shortly after hearing	Day 230-235
Appeal Deadline Expires	30 days after Final Order	Day 260-265
Effective Date	Next business day	Day 261-266
Settlement Fund Final Payment	Within 20 days of Effective Date	Day 281-286
Payments to Claimants Begin	Within 45 days of Effective Date	Day 306-311

```

Why was there a class action settlement?

This settlement resolves allegations that Cencora and The Lash Group failed to adequately protect personal information, resulting in a data breach. The plaintiffs claim they suffered harm due to the unauthorized access of their sensitive data.

Cencora denies any wrongdoing but agreed to settle to avoid the risks, costs and uncertainty of continued litigation.