The settlement follows a class action suit regarding a 2024 data breach.
What happened
In 2024, Cencora Inc., a pharmaceutical company that owns The Lash Group, faced a large data breach estimated to impact over 1.43 million individuals.
When the breach was first disclosed to the U.S. Securities and Exchange Commission on February 21st, 2024, it was believed that a relatively small number of individuals had been impacted. However, in the months following the initial notice, Cencora updated the SEC filing, stating that far more data had been stolen than initially thought. It’s now believed that at least 37 pharmaceutical companies that do business with Cencora were impacted.
Stolen information included names, addresses, dates of birth, passport information, Social Security numbers, health and insurance information, financial information, transactional information, financial information, gender, racial, and genetic information, and more.
Ultimately, the breach was reported separately and resulted in multiple different notices, making it difficult to fully evaluate the number of affected individuals. TechCrunch monitored the incident and calculated the number of impacted individuals by following submissions to various State Attorneys General. They determined that at least 1.43 million individuals were impacted, but since not every state publishes this information, it’s likely that there were far more victims.
What’s new
Since then, multiple class action suits were filed and ultimately consolidated into a single action, Anaya et Al. v. Cencora, Inc., et al. The suit alleged Cencora failed to “implement reasonable and appropriate safeguards to protect sensitive data, and as a result of that negligence, sensitive data was stolen.”
Cencora ultimately decided to settle the lawsuit with no admission of wrongdoing or liability. A $40 million settlement fund will cover attorney fees, service awards to the 28 class representatives, and settlement administration costs. Additional funds will go towards the class action members, who may submit claims for reimbursement. Claims are capped at $5,000 per class member.
FAQs
What happens when there are multiple class action lawsuits?
Generally, class action lawsuits become consolidated with multiple plaintiffs. This helps ensure every class action member, no matter which suit they were initially in, receives equal treatment. In cases where lawsuits have different, unrelated allegations, the lawsuits will be filed separately.
Why are class action suits so common?
Class action suits are sometimes the only way for members to receive compensation following a data breach, as once data is on the dark web, it cannot be taken down. Class action suits are also a way to encourage other businesses to prioritize cybersecurity, as every organization wants to avoid a suit.
Abby Grifno
