Individuals who received notice of the PharMerica data breach may be eligible to claim up to $10,000 plus credit monitoring from a $5.275 million class action settlement.
If your personal information was exposed in the PharMerica data breach, there’s a settlement with your name on it. PharMerica Corporation agreed to resolve a class action lawsuit stemming from a ransomware attack in March 2023 that compromised the personal information of patients served by its pharmacy network.
The company denies any wrongdoing but chose to settle rather than face a drawn-out trial. The result: real money available to people who were affected – and you don’t need a lawyer or extensive paperwork to get it.
Who can file a claim?
Individuals must meet all of the following criteria:
- They are a living U.S. resident.
- Their personal information was compromised in the PharMerica data breach that occurred in March 2023.
- They received notice of the data breach from PharMerica.
Were you affected by the PharMerica data breach? You may be owed up to $10,000.
File Your Claim NowHow much can class members receive?
Class members can claim several types of awards, depending on their circumstances and the documentation they provide:
- Documented losses (Cash Payment A): Up to $10,000 for unreimbursed out-of-pocket expenses incurred as a result of the data breach – fraudulent charges, identity theft expenses, credit monitoring costs, professional fees, and communication charges. Requires documentation such as receipts, bills, or other third-party records. Self-prepared documents alone are not sufficient.
- Pro rata cash payment (Cash Payment B): An equal share of the remaining settlement fund distributed among all valid claimants. No documentation required beyond the claim form itself.
- Credit monitoring: One year of Kroll Complete Monitoring including credit monitoring, dark web surveillance, identity theft restoration, $1,000,000 in fraud insurance, and real-time alerts. No documentation required and automatically available to all class members.
How to claim a data breach payment
Class members can submit the online claim form or download, print, complete and mail the PDF claim form to the settlement administrator. The claim deadline is April 27, 2026.
PharMerica Data Breach Settlement, c/o Kroll Settlement Administration LLC, P.O. Box 225391, New York, NY 10150-5391
What proof or documentation is necessary to submit a claim?
- All claimants should provide their name and contact information as it appeared in the breach notification they received.
- Claimants filing for documented losses (Cash Payment A) must provide supporting documentation such as receipts, bills, or other third-party records. Self-prepared documents alone are not sufficient.
- Claimants filing for the pro rata cash payment (Cash Payment B) do not need to provide documentation beyond the claim form itself.
- Claimants electing credit monitoring do not need to provide additional documentation.
Payout options
- Physical check (for mailed claim forms)
- Electronic payment (for online claim forms)
Settlement fund breakdown
The settlement fund covers:
When is the PharMerica data settlement payout date?
The settlement administrator will issue payments after the court grants final approval at the May 12, 2026 hearing and resolves any appeals. No specific payout date has been announced – this is standard at this stage of the process.
Why did this class action settlement happen?
The class action lawsuit alleged PharMerica Corporation experienced a ransomware attack in March 2023 by a cybercriminal group known as Money Message. The attackers gained unauthorized access to PharMerica’s systems and stole sensitive personal data, including Social Security numbers and health insurance information.
The plaintiffs claimed PharMerica failed to implement adequate cybersecurity measures to protect patient data, despite operating in an industry with heightened data security obligations under HIPAA.
PharMerica denies any wrongdoing but agreed to settle to avoid the uncertainty and expense of litigation.
Is the PharMerica data breach settlement legitimate?
Yes – this is a fully court-supervised settlement. Here’s what confirms it:
- Case number: 3:23-cv-00297-RGJ-CHL, filed in the U.S. District Court for the Western District of Kentucky
- Administrator: Kroll Settlement Administration LLC, an independent third-party claims administrator
- Official site: pmcsettlement.com
- Notice: Sent directly by the settlement administrator – not by PharMerica
The settlement has received court approval and is currently accepting claims. The final fairness hearing is scheduled for May 12, 2026. Claims must be filed before April 27, 2026 – no payments will be issued before final approval.
How much will I actually receive from the PharMerica settlement?
It depends on two things: what you claim and how many people file. The $5.275 million fund is split among all valid claimants after deducting attorneys’ fees and administration costs.
- Pro rata cash (no docs needed) – Cash Payment B. The exact amount depends on how many people file. If participation is low, each claimant gets more.
- Up to $10,000 (documented losses) – Cash Payment A. Requires receipts, bills, or third-party records proving expenses tied to the breach.
- Credit monitoring – one year of Kroll Complete Monitoring with $1,000,000 fraud insurance, available to everyone at no cost.
The $10,000 headline figure is the theoretical maximum for documented losses. Most people will receive the pro rata cash payment plus credit monitoring – which is still worth filing for.
What actually happened in the PharMerica data breach?
In March 2023, PharMerica Corporation – a pharmacy services provider operating across the United States serving long-term care facilities – was hit by a ransomware attack carried out by the cybercriminal group known as Money Message.
What was exposed: Names, Social Security numbers, dates of birth, health insurance information, medication lists, and other sensitive patient data. The breach affected a significant number of individuals who received pharmacy services through PharMerica’s network.
What the lawsuit claims: That PharMerica failed to implement reasonable cybersecurity measures to protect patient data, despite operating in an industry with heightened data security obligations under HIPAA.
What PharMerica says: They deny any wrongdoing – but agreed to a $5.275 million settlement rather than face trial.
Why do companies settle data breach lawsuits even when they deny wrongdoing?
Settlement does not mean admission of guilt. Companies settle for practical reasons:
- Litigation is expensive – legal fees alone can exceed the settlement amount
- Trials are unpredictable – a verdict could result in a far larger payout
- Settling ends years of ongoing litigation and negative press
- For plaintiffs, it guarantees a payout rather than risking nothing at trial
Courts still review every class action settlement to confirm it’s fair and reasonable – that’s what the May 12, 2026 fairness hearing is for. Denying wrongdoing while settling is standard practice and has no effect on your right to file a claim.