Cencora Incident Settlement 2026: What the $40 Million Payout Means for You
Quick Answer
- The Cencora data security incident settlement is a real, court-approved $40 million class action, not a scam text.
- Documented Loss Payments top out at $5,000 per person; Cash Fund Payments depend on total claims and are not yet determined.
- The claim filing window closed on January 19, 2026, so the only question left for most people is when payment arrives.
If you got a notice about the Cencora data security incident settlement, you’re not imagining it. A federal judge in Pennsylvania signed off on the deal in February 2026, closing out a class action that had been moving through court since 2024.
The case affects people whose personal or health information sat inside Cencora or The Lash Group’s systems when hackers broke in. If you filed a claim by the January 19, 2026 deadline, the number that matters now isn’t “how do I apply.” It’s “when do I get paid.”
This article covers who’s covered, how much money is actually on the table, and what’s confirmed versus what’s still an estimate. One detail that surprises a lot of readers: Cencora didn’t just disclose one wave of stolen data. It came back months later and said the breach was bigger than first reported.
The Facts
| Case | Anaya, et al. v. Cencora, Inc., et al., No. 2:24-cv-02961-CMR |
| Status | Final approval granted February 11, 2026 |
| Fund Size | $40,000,000 |
| Est. Per Person | Up to $5,000 (Documented Loss Payment); Cash Fund Payment amount not yet determined |
| Claim Deadline | January 19, 2026 (closed) |
| Administrator | Kroll Settlement Administration LLC |
| Proof Needed | Documented Loss Payment: receipts, statements, or invoices. Cash Fund Payment: none required |
Is the Cencora Data Security Incident Settlement Legit?
Yes, this is a real, court-supervised settlement, not a phishing scheme. It’s the result of an actual federal lawsuit, Anaya v. Cencora, filed in the U.S. District Court for the Eastern District of Pennsylvania.
The case sits before Judge Cynthia M. Rufe under case number 2:24-cv-02961-CMR. A court-appointed settlement administrator, Kroll Settlement Administration LLC, is handling claims, not Cencora itself and not a random third party.
You can confirm every detail through the official settlement website, CencoraIncidentSettlement.com. That’s the one source you should trust over any text message or unsolicited call claiming to speed up your payment.
Reality Check: No legitimate settlement administrator asks you to pay a fee, wire money, or hand over a bank PIN to release your payment. If anyone contacts you demanding cash upfront to “process” your Cencora claim, that’s a scam, and you should report it and ignore it.
Why Did Cencora Agree to Pay $40 Million?
Cencora agreed to the fund to settle claims that it failed to protect personal and health information during a 2024 cyberattack. The company denies wrongdoing but chose to settle rather than keep litigating.
On February 27, 2024, Cencora filed an SEC Form 8-K disclosing that unknown parties had accessed its information systems. At the time, the scope looked limited.
That changed on July 31, 2024. Cencora told the SEC that more data had actually been exfiltrated than first believed, including personal and protected health information tied to one of its subsidiaries providing patient-support services. The settlement agreement lists 42 business customers whose information was involved in the incident.
Key Takeaway: Cencora’s own disclosures grew twice, first in February 2024 and again in July 2024, which is part of why plaintiffs argued the company understated the breach.
How Much Money Can You Get From the Cencora Settlement?
You can receive one of two payment types, but not both. The amount depends heavily on which one you chose and how many other people filed valid claims.
Documented Loss Payment: covers actual, unreimbursed losses tied to the breach, up to $5,000 per person, drawn from a $5 million pool inside the larger fund. If total approved claims exceed that pool, payments get reduced on a pro rata basis.
Cash Fund Payment: a flat payment requiring no proof of loss, drawn from whatever remains in the $40 million fund after documented loss payments, administrative costs, legal fees, and service awards are paid out. This amount is not yet determined because it depends on final claim counts.
| Payment Type | Documentation Required | Maximum | Funding Source |
|---|---|---|---|
| Documented Loss Payment | Yes: receipts, bank or credit statements, invoices | $5,000 | $5 million capped pool |
| Cash Fund Payment | No | Not yet determined | Remainder of $40 million fund |
Do California Residents Get More Money?
Yes, class members who live in California may receive double the payment amount awarded to non-California class members. This comes from California statutory damages provisions tied to data breach claims, not a separate fund.
The multiplier applies automatically based on residency at the time of filing. It doesn’t require a separate form or extra documentation beyond your standard claim.
Key Takeaway: Payment amounts aren’t flat and uniform. They shift based on claim type, total claim volume, and whether you’re a California resident.
What Is a Documented Loss Payment vs. a Cash Fund Payment, in Plain Terms?
Think of it like a store return policy. If you kept your receipt (bank statements, fraud alerts, credit monitoring bills), you can ask for reimbursement of the actual cost.
If you didn’t keep records but you’re still a verified class member, you can take a flat, no-questions-asked payment instead. The tradeoff is you can’t do both.
Class members had to pick one option on their claim form:
- Confirm eligibility as a Cencora or Lash Group class member.
- Choose Documented Loss Payment or Cash Fund Payment.
- If choosing Documented Loss, attach proof: receipts, statements, screenshots, or invoices.
- Submit online or by mail before January 19, 2026.
- Wait for the administrator to review for completeness.
- Respond to any request to “cure” an incomplete claim.
How to File a Claim for the Cencora Settlement
This section is here for context because people still search it, but here’s the direct answer: the claim filing window has closed. The deadline was January 19, 2026, whether submitted online or postmarked by mail.
If you filed before that date, your claim is now sitting in the administrator’s review queue. There’s nothing further required from you unless Kroll contacts you asking to fix a deficiency.
For anyone who filed a Documented Loss Payment claim that came in incomplete, the settlement terms allow the administrator to convert it into a Cash Fund Payment claim automatically, as long as you were a valid class member. That’s a built-in safety net, not an automatic denial.
What if You Missed the January 19, 2026 Claim Deadline?
Missing the deadline generally means you’re no longer eligible for a cash payment from this fund. The settlement terms didn’t include a formal late-claims process as of this writing.
You remain bound by the settlement’s release of claims unless you filed a valid Request for Exclusion by December 18, 2025. That means you generally can’t sue Cencora separately over this same incident going forward.
If you believe you were a class member but never received notice, contacting the settlement administrator directly is the only realistic path to check your status. Kroll can be reached at (833) 621-8029 or through the official settlement website.
Key Takeaway: Both the exclusion deadline (December 18, 2025) and the claim deadline (January 19, 2026) have already passed as of mid-2026, so this stage of the case is closed to new filers.
How to Check Your Cencora Settlement Claim Status
You can check your status directly on the official settlement website using your Class Member ID. If you never got that ID, you can request it through the site or by phone.
Steps to check your status:
- Go to the official Cencora Incident Settlement website.
- Locate the claim status or “check your claim” tool.
- Enter your Class Member ID and identifying details.
- Review any notice of deficiency, if flagged.
- Contact Kroll Settlement Administration if your status hasn’t updated in several weeks.
Has the Cencora Settlement Received Final Approval?
Yes, the court granted final approval on February 11, 2026. The final approval hearing itself took place February 5, 2026, before Judge Cynthia M. Rufe in Philadelphia.
Final approval means the judge reviewed the settlement terms, attorneys’ fee request, and any objections, then signed off on the deal as fair and reasonable. Attorneys’ fees are capped at up to one-third of the fund, plus up to $300,000 in costs. Named plaintiffs can receive service awards up to $1,500 each.
Final approval is a major milestone, but it isn’t the same as payment. Funds typically don’t move until after any appeal window closes or appeals get resolved.
When Will Cencora Settlement Checks Be Mailed in 2026?
An exact payment date is not yet confirmed. Estimates from sources tracking the case range from roughly 75 days after final approval to as late as July 2026, depending on claims processing time and any appeals.
This is the one area where competing settlement-tracking sites disagree, and none of them are the official source. The only place to get a confirmed payment date is the official settlement website itself.
Here’s what is confirmed: payment cannot legally begin until the settlement becomes final, meaning the appeal period has expired or any appeal has been resolved. That structure is standard for class action settlements this size.
Reality Check: If you see a site promising an exact “your check ships on this date” figure with total confidence, treat it skeptically. Even the settlement administrator describes the payment date as an estimate subject to change.
Is There an Appeal Delaying the Cencora Payout?
As of this writing, no confirmed appeal of the final approval order has been publicly reported. That status can change, so it’s worth checking the settlement website periodically.
If an appeal were filed, it would extend the payment timeline further, since funds are held until the appeal is resolved. This is the biggest wildcard for anyone waiting on a check.
A useful comparison: this is a lot like waiting on a delayed tax refund tied to a processing hold. You’ve been told the amount is coming, but the exact release date depends on steps outside your control.
What Happened in the Cencora Data Security Incident?
The Cencora data security incident was a cyberattack disclosed in February 2024 that exposed personal and health information tied to Cencora and its subsidiary, The Lash Group. Unknown parties improperly accessed company information systems.
Cencora, formerly known as AmerisourceBergen, is a major pharmaceutical distribution company headquartered in Conshohocken, Pennsylvania. The Lash Group manages patient-support and insurance-benefit programs for pharmaceutical clients, which is why the breach touched so many downstream patients who never directly interacted with Cencora.
The company’s public estimate of affected individuals was never formally disclosed in a single number. However, notifications sent to state attorneys general suggested more than 1.4 million people in the U.S. may have had data involved, a figure that is separate from the confirmed 42 business customers named in the settlement agreement.
Who Is Eligible for the Cencora Data Security Incident Settlement?
You may qualify if you’re a U.S. resident whose personal information was involved in the incident and you received notice of it. Eligibility isn’t limited to people who got a physical letter.
The Settlement Class includes:
- Individuals who received mailed notice of the incident.
- Individuals who received substitute notice through Cencora’s website or a media release.
- People on “Inquiry Notice,” meaning circumstances between September 1, 2023, and August 5, 2025, that would reasonably suggest harm from the incident, such as an unexpected explanation of benefits or a bank fraud alert.
- Current or former Cencora employees who received Incident Notice and whose information was involved.
If none of these apply to you, you’re not part of this particular class, even if you’re a Cencora customer generally.
What Is Anaya v. Cencora, Inc.?
Anaya v. Cencora is the lead case name for the consolidated class action lawsuit behind this settlement. It’s filed as case number 2:24-cv-02961-CMR in the Eastern District of Pennsylvania.
Court-appointed Class Counsel representing plaintiffs includes attorneys from Seeger Weiss, Scott+Scott Attorneys at Law, Ahdoot and Wolfson, Hausfeld LLP, and Fine, Kaplan, and Black. Plaintiffs and Cencora reached the deal after mediation, avoiding a trial.
You were automatically represented by Class Counsel unless you hired your own lawyer or excluded yourself from the class before the December 18, 2025 deadline.
Who Is Kroll Settlement Administration?
Kroll Settlement Administration LLC is the court-appointed third party managing claims, payments, and notices for this case. It is not Cencora, and it is not a debt collector.
Kroll’s role is limited to processing claim forms, verifying eligibility, and eventually distributing funds once the court authorizes payment. You can reach Kroll at (833) 621-8029 or by mail at the address listed on the official claim form.
If you ever get contacted by someone claiming to be from Kroll asking for upfront payment or gift cards, that is not how a legitimate settlement administrator operates.
What Happens Next
February 11, 2026: Final approval granted by the court.
Ongoing: Kroll reviews submitted claims for validity and completeness.
Expected mid-2026: Payments begin distributing to approved claimants, pending resolution of any appeal.
Expected later 2026: Remaining Cash Fund Payment amounts finalize once total valid claims are known.
Frequently Asked Questions
Is the Cencora incident settlement real?
Yes. It’s a court-approved class action settlement stemming from Anaya v. Cencora, Inc.
The case is active in the U.S. District Court for the Eastern District of Pennsylvania.
Final approval was granted February 11, 2026.
How much is the Cencora data security settlement worth?
The total fund is $40 million.
Individual payments range from a pro rata Cash Fund Payment up to $5,000 for Documented Loss claims.
Final per-person amounts depend on how many valid claims were filed.
Can I still file a claim for the Cencora settlement?
No, the claim deadline was January 19, 2026, and it has passed.
There is no confirmed late-filing process for this settlement.
Contact Kroll Settlement Administration directly if you believe you were wrongly excluded from notice.
When will I get my Cencora settlement check?
An exact date is not yet confirmed.
Estimates range from roughly 75 days after final approval to as late as July 2026.
Check the official settlement website for the most current payment timeline.
Who qualifies for the Cencora data security incident settlement?
U.S. residents whose personal information was involved in the incident and who received notice qualify.
This includes mailed notice, substitute notice, or those on “Inquiry Notice” tied to suspicious activity between September 2023 and August 2025.
Current or former Cencora employees notified of the incident are also included.
Do I need proof to get a Cencora settlement payment?
Only if you chose the Documented Loss Payment option, which requires receipts, statements, or similar records.
The Cash Fund Payment option requires no documentation.
You could not select both options on one claim form.
Is Cencora the same company as AmerisourceBergen?
Yes, Cencora was formerly known as AmerisourceBergen before rebranding.
It’s a major pharmaceutical distribution company headquartered in Conshohocken, Pennsylvania.
The Lash Group, involved in this breach, operates as a Cencora subsidiary.
What was the Cencora data breach actually about?
Unknown parties gained unauthorized access to Cencora and The Lash Group information systems starting around February 2024.
Cencora disclosed the incident to the SEC in February 2024 and expanded the scope of the disclosure in July 2024.
Personal and protected health information tied to 42 business customers was involved.
The Cencora incident settlement has cleared its biggest legal hurdle, but the payment date is still the open question. Mark the official settlement website as your source for updates, not a third-party tracker guessing at timelines.
If you filed a claim before January 19, 2026, there’s nothing left to do but wait and watch for the administrator’s next notice.
