Cencora/The Lash Group Data Security Incident Settlement
Up to $5,000
This settlement is closed to new claims — the deadline was January 19, 2026. You can still see what it was about and follow the case in court below. Looking for money you can still claim? Browse open settlements →
What happened
On February 27, 2024, Cencora disclosed that its information systems had been improperly accessed by unknown parties. The data breach exposed Personal Information including names, addresses, Social Security numbers, health and insurance information, financial account information, and other sensitive data. Cencora has agreed to pay $40,000,000 and implement enhanced data and information security measures to resolve claims arising from this incident.
Do you qualify?
All individuals and persons who reside in the United States and its territories whose Personal Information was involved in the incident and received mailed notice or substitute notice through the website/media press release, or who were on "Inquiry Notice" because they experienced potential fraud indicators (such as unexpected explanation of benefits or bank fraud alerts) between September 1, 2023 and August 5, 2025.
How to file
Submit a Claim Form online at the Settlement Website or by mail to the Settlement Administrator by January 19, 2026. For a Documented Loss Payment of up to $5,000, include supporting documentation of losses or unreimbursed expenses incurred after September 1, 2023. Alternatively, you may submit a Claim Form for a cash payment with no documentation required.
Common questions
- How much does the Cencora/The Lash Group Data Security Incident Settlement pay?
- Estimated payout: Up to $5,000. The total settlement fund is $40M. Actual amounts depend on how many valid claims are filed — most settlements divide a fixed fund pro rata, so a higher claim rate means a smaller individual check. An "up to" figure is a cap, not a guarantee.
- What is the claim deadline for the Cencora/The Lash Group Data Security Incident Settlement?
- This settlement is closed to new claims — the deadline was January 19, 2026. Once a claim deadline passes you generally forfeit your share, even if you qualified.
- Do I need proof of purchase for the Cencora/The Lash Group Data Security Incident Settlement?
- No. You can file without a receipt or proof of purchase. You attest that you qualify and submit basic details, though claims are still subject to review and submitting a false claim is a crime.
- Is the Cencora/The Lash Group Data Security Incident Settlement notice real, or a scam?
- Kroll Settlement Administration LLC is the settlement administrator for this case. Claims are filed at cencoraincidentsettlement.com. Filing a class action claim is always free — no legitimate settlement charges you to claim, and no administrator will ask for payment, a gift card, or your full Social Security number by email or text. If a notice asks for any of those, it is not from the administrator. When in doubt, ignore the link you were sent and go to the official settlement website directly.
- When will payments from the Cencora/The Lash Group Data Security Incident Settlement be sent?
- Class action payouts typically take 12 to 24 months after the claim deadline, and longer if the settlement is appealed. The final approval hearing for this case is set for February 5, 2026; no payments can be issued before a settlement receives final approval.
New to class actions?
This summary was generated from public settlement documents and may contain errors. Confirm eligibility, deadlines, and payment terms on the official settlement website before filing. ClaimWatch is not a law firm and this is not legal advice. Filing a claim is free.
More privacy settlements
View all →Berman & Rabin Data Breach Settlement
Berman & Rabin, P.A. experienced a cyberattack on its computer systems in July 2024 (the "Data Incident"). Certain files containing private information were potentially accessed, including names, Social Security numbers, drivers' license numbers, financial information, medical information, and health insurance information. Berman & Rabin denies any wrongdoing, but the parties agreed to settle to avoid costs and risks of continued litigation.
Call-On-Doc Pixel Settlement
Call-On-Doc used third-party tracking technologies called "tracking pixels" on its web pages. Plaintiffs alleged this use violated certain California laws. Call-On-Doc denies wrongdoing, and the parties agreed to settle to avoid litigation costs and uncertainty.
FitOn VPPA Settlement
FitOn allegedly disclosed its subscribers' personally identifiable information to third parties without consent and in violation of the Video Privacy Protection Act (VPPA). The defendant denies it violated any law.
Up to $10
Serviceaide Data Breach Settlement
Serviceaide, Inc. experienced unauthorized access to its computer systems and network between September 19, 2024, and November 5, 2024, which exposed the private information of current and former patients of Catholic Health. The lawsuit alleges negligence, breach of implied contract, unjust enrichment, and invasion of privacy. The defendant denies all wrongdoing.