AllCare Plus Pharmacy Settlement Resolves Data Breach Lawsuit Over June 2022 Phishing Attack

New to ClassAction.org? Read our Newswire Disclaimer

A class action settlement has been reached to resolve a lawsuit that alleged AllCare Plus Pharmacy LLC failed to prevent a June 2022 phishing attack that exposed consumers’ personal and medical information.

Don’t miss the next class action settlement deadline. Sign up for ClassAction.org’s free weekly newsletter.

The court-approved website for the AllCare data breach settlement can be found at AllCareSettlement.com.

The deal with the Massachusetts-based pharmacy covers all United States residents whose private information was impacted by the AllCare Plus Pharmacy data breach, which occurred around June 21, 2022.

To receive AllCare class action settlement benefits, class members must submit a valid claim form online or by mail by July 3, 2025.

Head to this page to file an AllCare settlement claim form online. Alternatively, you can download a PDF claim form or contact the settlement administrator to request a paper copy to complete and return by mail.

To submit a claim form online, you will need to provide your unique claimant ID, which is located on the personalized settlement notice you should have received, and your last name.

According to the AllCare settlement website, class members who file a timely, valid claim form are eligible to receive up to $750 per person for unreimbursed, out-of-pocket “ordinary” losses that were “more likely than not” caused by the incident and are supported by documentation. Per the settlement website, these expenses may include losses linked to fraud or identity theft, attorney or credit repair service fees, credit monitoring costs, postage, mileage or other miscellaneous charges.

Class members may also submit a claim to receive up to $5,000 per person in reimbursement for documented “extraordinary” losses that were incurred after June 21, 2022 and are reasonably linked to the data breach.

In addition, consumers are eligible to receive compensation for up to five hours of documented lost time spent responding to the incident, at a rate of $20 per hour, the settlement website shares. Compensation for lost time will be included in the per-person cap for “ordinary” and “extraordinary” losses, as applicable.

Moreover, class members may enroll in two years of credit monitoring and identity theft insurance services at no cost, the settlement agreement relays.

Alternatively, consumers can choose to forego the aforementioned benefits in favor of a $50 cash payout.

As part of the deal, the site says, AllCare has made and will maintain certain security changes in response to the incident.

The terms of the AllCare settlement were preliminarily approved by the court on March 6, 2025. The parties now await a hearing set for August 27, 2025, at which the court will decide whether to grant final approval to the terms of the deal.

Class action settlement benefits are typically issued to eligible class members only after a deal receives ultimate court approval, and after any appeals are resolved.

According to the AllCare class action lawsuit, cybercriminals gained access to the pharmacy’s computer system using phishing emails that targeted employee inboxes. Per the data breach lawsuit, private information belonging to current and former patients and employees was compromised as a result of the cyberattack, including names, dates of birth, addresses, Social Security numbers, driver’s license numbers, financial account details and certain health insurance and medical data.

Head to ClassAction.org’s settlements page for a complete list of data breach settlements.