$40M Cencora, Lash Group Settlement Ends Class Action Lawsuit Over 2024 Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

A $40 million settlement will end a class action lawsuit against Cencora, The Lash Group and their affiliates over a February 2024 data breach that exposed patients’ personal information to unauthorized third parties.

Don’t miss out on class action settlement news like this. Sign up for ClassAction.org’s free weekly newsletter.

The Cencora/Lash Group class action settlement received preliminary court approval on August 22, 2025.

The settlement covers all United States residents whose data was involved in the Cencora/Lash Group data breach and who received mailed notice of the incident or substitute notice of the breach from Cencora’s website or media press release. The Cencora settlement also covers those who were on “inquiry notice” because of circumstances that occurred on or after September 1, 2023 through August 5, 2025 that suggested that the consumer is aware of harm potentially stemming from the unauthorized use of their personal information due to the data breach.

The court-approved website for the Cencora/Lash Group settlement can be found at CencoraIncidentSettlement.com.

Cencora settlement class members who submit a timely, valid claim form will be able to receive either up to $5,000 in reimbursement for documented losses related to the data breach or, alternatively, a pro rata (equal share) cash payment from the $40 million settlement fund.

In order to claim loss reimbursement, the settlement website states, a consumer’s losses must be related to the data breach and cannot have been already reimbursed by another source, such as the credit monitoring and identity theft protection Cenora offered to victims after the incident. Additionally, class members seeking reimbursement for these losses must provide reasonable supporting documentation, such as bank statements, insurance statements, credit card statements, telephone records, invoices, receipts or screenshots, the settlement site says.

Per the website, loss reimbursement through the class action settlement is mutually exclusive from the pro rata cash payment, and Cencora/Lash Group settlement class members can choose only one of these options.

To submit a claim form online, class members can visit this page and log in with the unique class member ID found in their copy of the settlement notice.

Alternatively, a PDF of the claim form is available to print, fill out and mail back to the address listed on the second page of the form.

All claim forms must be submitted online or postmarked by January 19, 2026.

Additionally, as part of the settlement, Cencora has agreed to update and strengthen its information and data security protocols to better protect patients’ data.

A hearing is scheduled for February 5, 2026 to determine whether the settlement will receive final court approval. Settlement benefits will begin to be distributed to class members only after final approval has been granted and any appeals have been resolved.

The Cencora class action lawsuit alleged that the healthcare company neglected to properly protect patients’ information from a February 2024 data breach that gave unauthorized third parties access to personally identifying information.

Head to ClassAction.org’s settlements page for a complete list of data breach settlements.