Cencora Inc. (formerly AmerisourceBergen) and its subsidiary, The Lash Group LLC, faced a class action lawsuit due to a data breach that exposed personal information. The company allegedly failed to implement adequate security measures, leading to unauthorized access to sensitive data. While Cencora denied wrongdoing, it agreed to a $40 million settlement to avoid prolonged litigation. The breach impacted individuals who were either directly notified or detected suspicious activity linked to the incident.Affected parties can claim up to $5,000 for documented losses (e.g., identity theft, financial fraud) or a pro rata cash payment if no documented loss exists. The settlement highlights the financial and reputational risks of inadequate data protection, as the breach led to potential fraud, identity theft, and legal repercussions. The deadline for claims is January 19, 2026, with submissions managed by Kroll Settlement Administration. The case underscores the growing legal and financial consequences of data breaches in healthcare and corporate sectors.

The Washington State Office of the Attorney General reported a data breach involving The Lash Group, LLC on May 31, 2024. The breach, which occurred on February 21, 2024, involved a cyberattack with personal information potentially including names, dates of birth, and medical information affecting 829 residents.