Cencora Data Security Settlement, Check If You Qualified — Anaya, et al. v. Cencora, Inc., No. 2:24-cv-02961-CMR (Claims Closed)

[Claims Closed — This settlement’s filing deadline passed January 19, 2026. This article is kept live for reference. If you filed a claim, keep reading for the payment timeline. If you didn’t file, you did not receive a payment, but the settlement’s terms still apply to you.]

If you received a letter or notice earlier saying your personal information was caught up in the Cencora or The Lash Group data breach, here’s where things stand: the court gave final approval to Cencora’s $40 million settlement, and the settlement administrator expects to start sending payments in September 2026. Here’s what happened, who was covered, and what to do if you’re still waiting.

Cencora Data Security Settlement — Key Facts

Settlement Amount	$40,000,000
Claim Deadline	January 19, 2026 — CLOSED
Who Qualified	U.S. residents and territory residents whose personal information was involved in the incident and who received notice, or were on “inquiry notice,” between September 1, 2023 and August 5, 2025
Estimated Payout	Documented Loss Payment up to $5,000 (capped pool of $5,000,000); or a Cash Fund Payment, amount pro rata based on remaining funds and total claims — California residents receive double the Cash Fund Payment amount
Proof Required (Yes/No)	Yes, for a Documented Loss Payment; No, for a Cash Fund Payment
Settlement Status	Final approval granted in February 2026; claims closed; payments expected to begin September 2026
Court & Case Number	U.S. District Court for the Eastern District of Pennsylvania — No. 2:24-cv-02961-CMR, Judge Cynthia M. Rufe
Law Alleged	Negligence for failing to implement reasonable and appropriate data security safeguards
Administrator	Kroll Settlement Administration LLC, P.O. Box 225391, New York, NY 10150-5391; (833) 621-8029
Official Claim Site	cencoraincidentsettlement.com
Last Updated	September 21, 2026

Who Are Cencora and The Lash Group, and Why Were They Sued?

Cencora, formerly AmerisourceBergen, is one of the largest pharmaceutical distribution companies in the country. The Lash Group is a Cencora subsidiary that runs patient support programs for drug manufacturers — meaning it handles unusually sensitive information, including health and insurance details, for patients who never chose to do business with it directly. That’s the part that made this breach worse than a typical retailer hack: the data at risk wasn’t just names and emails.

What Happened, and What Did Cencora Do About It?

Cencora disclosed the breach in a February 27, 2024 filing with the Securities and Exchange Commission, saying unauthorized parties had accessed its systems. The follow-up investigation found the exposed data could include Social Security numbers, health and insurance records, financial account information, driver’s license and passport numbers, and even more sensitive categories like genetic information and racial or ethnic identity data. According to class counsel, more than 11.6 million people ended up covered by the settlement class.

Multiple lawsuits followed and were consolidated into Anaya, et al. v. Cencora, Inc., et al., alleging the companies were negligent for not having reasonable safeguards in place. Cencora denies any wrongdoing and settled to avoid the cost and risk of continuing to litigate — a common move even when a company believes it did nothing wrong.

That’s the whole arc: a breach disclosed to regulators, lawsuits that followed fast, and a settlement reached before trial. Nothing here required Cencora to admit fault, and nothing here proves it didn’t happen the way plaintiffs described.

Who Qualified for the Cencora Settlement?

You were part of the Settlement Class if you’re a U.S. or U.S. territory resident whose personal information was involved in the incident, and you either received formal notice of the breach, or you were on “inquiry notice” — meaning something happened, like an unexpected fraud alert or benefits statement, that a reasonable person would have traced back to this breach, between September 1, 2023 and August 5, 2025.

Not included: judges assigned to the case and their families, Cencora’s own executive leadership and board, and anyone who filed a valid request to be excluded by the December 18, 2025 deadline.

Was This Settlement Available Outside the U.S.?

Yes, in a specific sense — the class includes residents of U.S. territories, not just the fifty states. If you live outside the U.S. and its territories entirely, you weren’t part of this class regardless of whether your data was affected.

If you’re still dealing with fraud or identity theft you believe traces back to this breach and you excluded yourself from the settlement, a data privacy attorney can tell you whether pursuing an individual claim makes sense now that the class settlement has closed.

How Much Could Cencora Class Members Get?

Class members who filed a valid claim before January 19, 2026 chose between two options, not both. A Documented Loss Payment covered actual, unreimbursed losses tied to the breach — up to $5,000 per person — but required supporting documentation, and the total pool for these payments was capped at $5 million. Anyone who preferred not to gather paperwork could instead file for a Cash Fund Payment with no documentation required, though that payment’s size depends entirely on how many people filed and how much money is left after documented-loss payments, fees, and administrative costs are paid out.

California residents who chose the Cash Fund Payment option get double what other class members receive, under a state-specific provision built into the settlement.

Where the Money Actually Goes First

Before any class member sees a payment, the fund covers Class Counsel’s fees — requested at up to one-third of the $40 million fund, or $13,333,333.33 — plus up to $300,000 in litigation costs and $1,500 service awards to each of the 28 class representatives, a total of $42,000. What’s left funds the claims. Payments over $600 may be reported on a 1099; check with a tax professional if that applies to you.

What Should You Do If You Already Filed a Claim?

1. There’s nothing left to file — the claim window closed January 19, 2026.
2. Keep an eye on the official settlement site, cencoraincidentsettlement.com, for payment updates.
3. As of the site’s most recent update, the administrator expects to begin distributing payments in September 2026, after processing a large volume of claims.
4. If your mailing or payment information changed since you filed, contact the settlement administrator directly at (833) 621-8029.
5. Watch for a check or digital payment matching the method you selected on your Claim Form.
6. If you never received a payment and believe you filed correctly, contact Kroll Settlement Administration before assuming the claim was lost.

What If You Never Filed a Claim?

If you didn’t submit a Claim Form by January 19, 2026, you won’t receive a payment — but you’re still bound by the settlement’s release of claims unless you separately excluded yourself by December 18, 2025. That means you generally can’t sue Cencora or The Lash Group over this same incident going forward, even without a payment to show for it.

Cencora Data Security Settlement — Key Dates

Milestone	Date
Cencora discloses incident to the SEC	February 27, 2024
Settlement reached (agreement in principle)	Around July 28, 2025
Exclusion and Objection Deadline	December 18, 2025
Claim Filing Deadline	January 19, 2026
Final Approval Hearing	February 5, 2026
Final Approval Granted	On or about February 11, 2026
Payment Distribution Begins	Expected September 2026, per the settlement administrator’s most recent update

Cencora Data Security Settlement — Frequently Asked Questions

Do I need a lawyer to have filed a Cencora settlement claim? 

No. The court appointed Class Counsel — including attorneys from Seeger Weiss, Scott+Scott, Ahdoot & Wolfson, Hausfeld, and Fine, Kaplan and Black — to represent the class at no direct cost to class members.

Is the Cencora data breach settlement legitimate?

 Yes. It’s a real, court-approved settlement in Anaya, et al. v. Cencora, Inc., et al., Case No. 2:24-cv-02961-CMR, in the U.S. District Court for the Eastern District of Pennsylvania, and it received final approval in February 2026.

When will Cencora settlement payments be sent? 

The settlement administrator’s most recent update, posted August 24, 2026, said distribution is expected to begin in September 2026, after processing a large volume of submitted claims.

What if I missed the Cencora settlement claim deadline? 

If you didn’t submit a valid claim by January 19, 2026, you’re not eligible for a payment. You’re still bound by the settlement’s terms unless you filed a valid exclusion request by December 18, 2025.

Will my Cencora settlement payment go on a 1099? 

Possibly. Payments over $600 may be reported on a 1099 form. Check with a tax professional about your specific situation.

What’s the difference between a Documented Loss Payment and a Cash Fund Payment?

 A Documented Loss Payment reimburses actual, proven losses up to $5,000 but requires supporting paperwork. A Cash Fund Payment requires no documentation, but its amount isn’t fixed — it depends on how many people filed and how much of the fund remains.

Why do California residents get more money from this settlement?

 Class members who reside in California and chose the Cash Fund Payment option receive twice the amount paid to non-California class members, under a state-specific provision negotiated into the settlement.

What data was exposed in the Cencora breach? 

According to the settlement notice, exposed information could include names, addresses, dates of birth, Social Security numbers, health and insurance information, financial account information, driver’s license and passport numbers, IP addresses, and in some cases biometric or genetic information.

Sources Used in This Article

• Official Settlement Website — Cencora/The Lash Group Data Security Incident Settlement: https://www.cencoraincidentsettlement.com/
• U.S. Securities and Exchange Commission — Cencora, Inc. Form 8-K/A: https://www.sec.gov/Archives/edgar/data/1140859/000110465924084351/tm2420501d1_8ka.htm
• U.S. Securities and Exchange Commission — Cencora, Inc. Form 8-K (settlement agreement in principle): https://www.sec.gov/Archives/edgar/data/1140859/000110465925087080/tm2524806d1_8k.htm
• HIPAA Journal — “Cencora & The Lash Group Settle Data Breach Litigation for $40 Million”: https://www.hipaajournal.com/cencora-cyberattack-data-breach/
• Fine, Kaplan and Black, R.P.C. — “Anaya v. Cencora” case summary: https://www.finekaplan.com/cases/blog-post-title-one-zknsz-83ss5-mjw7b-pftf4

Researched and written by Israr Ahmad, legal content researcher and founder of AllAboutLawyer.com. Facts verified against the official settlement website, Cencora’s SEC filings, and Class Counsel’s own case summary on September 21, 2026. Last Updated: September 21, 2026.

This article is for informational purposes only and does not constitute legal advice. Laws vary by state and individual circumstances differ. For advice about your specific situation, consult a qualified attorney.