Cencora Inc. (formerly AmerisourceBergen) and its subsidiary, The Lash Group LLC, faced a class action lawsuit due to a data breach that exposed personal information. The company allegedly failed to implement adequate security measures, leading to unauthorized access to sensitive data. While Cencora denied wrongdoing, it agreed to a $40 million settlement to avoid prolonged litigation. The breach impacted individuals who were either directly notified or detected suspicious activity linked to the incident.Affected parties can claim up to $5,000 for documented losses (e.g., identity theft, financial fraud) or a pro rata cash payment if no documented loss exists. The settlement highlights the financial and reputational risks of inadequate data protection, as the breach led to potential fraud, identity theft, and legal repercussions. The deadline for claims is January 19, 2026, with submissions managed by Kroll Settlement Administration. The case underscores the growing legal and financial consequences of data breaches in healthcare and corporate sectors.
Source: https://www.knoe.com/2025/10/06/better-business-bureau-explains-cencora-class-action-settlement/
TPRM report: https://www.rankiteo.com/company/lash-group
"id": "las5393353100625",
"linkid": "lash-group",
"type": "Breach",
"date": "10/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Healthcare / Pharmaceutical Distribution',
'name': 'Cencora Inc.',
'type': 'Corporation'},
{'industry': 'Healthcare Services',
'name': 'The Lash Group LLC',
'type': 'Subsidiary/Company'}],
'customer_advisories': 'Customers advised to file claims by January 19, 2026, '
'via online form or mail to: Cencora Data Security '
'Incident Settlement Administrator c/o Kroll '
'Settlement Administration LLC P.O. Box 225391 New '
'York, NY 10150-5391.',
'data_breach': {'data_exfiltration': 'Likely (alleged in lawsuit)',
'personally_identifiable_information': True,
'sensitivity_of_data': 'High (personal information)',
'type_of_data_compromised': 'Personal information'},
'description': 'Cencora Inc. and The Lash Group LLC agreed to pay $40 million '
'to settle a class action lawsuit for alleged failures to '
'protect personal information, leading to a data breach. The '
'settlement covers individuals directly notified or those who '
'discovered suspicious activity tied to the breach. Claimants '
'can receive up to $5,000 for documented, unreimbursed '
'expenses or a pro rata cash payment. Claims must be filed by '
'January 19, 2026.',
'impact': {'brand_reputation_impact': 'Likely negative (class action lawsuit '
'and settlement)',
'data_compromised': 'Personal information',
'financial_loss': '$40 million (settlement amount)',
'identity_theft_risk': 'High (personal information compromised)',
'legal_liabilities': '$40 million settlement'},
'investigation_status': 'Settled (class action lawsuit resolved)',
'post_incident_analysis': {'root_causes': 'Alleged failures to protect '
'personal information (details '
'unspecified in source).'},
'references': [{'date_accessed': '2025',
'source': 'KNOE News (Good Morning ArkLaMiss)'},
{'date_accessed': '2025',
'source': 'Better Business Bureau (BBB) statement via Jo Ann '
'Deal'}],
'regulatory_compliance': {'legal_actions': 'Class action lawsuit settled for '
'$40 million'},
'response': {'communication_strategy': 'Class action settlement notifications '
'and public disclosure via BBB and '
'media (KNOE).'},
'stakeholder_advisories': 'Settlement notifications sent to affected '
'individuals; claim submission process established.',
'title': 'Cencora and The Lash Group LLC Data Breach Class Action Settlement',
'type': 'Data Breach'}