Federal Court Preliminarily Approves $5.275M Settlement in PharMerica Data Breach Class Action
Key Takeaways
- A federal judge preliminarily approved a $5.275 million nationwide class action settlement resolving claims arising from PharMerica’s March 2023 ransomware-related data breach.
- The proposed settlement provides pro rata cash payments, up to $10 000 for documented losses, and 1 year of credit and identity monitoring services for affected individuals.
- The case underscores the ongoing litigation and financial risks health care entities face following large-scale breaches of personally identifiable information (PII) and protected health information (PHI).
A federal judge in the US District Court for the Western District of Kentucky has preliminarily approved a $5.275 million nationwide class action settlement resolving claims arising from PharMerica Corporation’s March 2023 data breach.
In Lurry v PharMerica Corp (Civil Action No. 3:23-cv-297-RGJ [WD Ky 2026]) the court granted plaintiffs’ unopposed motion for preliminary approval of the proposed settlement on January 12, 2026. The litigation consolidated multiple lawsuits filed after a ransomware attack allegedly compromised sensitive personal and health information.
Background: 2023 Ransomware Incident
PharMerica, a pharmacy services provider serving long-term care facilities, senior living communities, hospitals, and other healthcare settings nationwide, collects and maintains PII and PHI of patients and employees.
According to the complaint, in March 2023, a cybercriminal ransomware group targeted the company’s network and exfiltrated approximately 4.7 terabytes of data, including plaintiffs’ personal information. The resulting litigation alleged that PharMerica failed to adopt, implement, and maintain adequate security measures to safeguard that information.
The court previously granted in part and denied in part PharMerica’s motion to dismiss in June 2024. Following informal discovery and mediation in August 2025, the parties reached a settlement agreement. PharMerica denies wrongdoing but agreed to resolve the claims through the proposed settlement.
Scope of the Settlement Class
The proposed settlement class includes: “All living persons in the United States who were provided notice of the Data Incident.” Excluded from the class are PharMerica’s directors and officers, governmental entities, individuals who validly opt out, and the presiding judge and related court personnel.
Settlement Structure and Monetary Relief
The settlement includes a $5.275 million non-reversionary settlement fund. After payment of administration costs, service awards, and attorneys’ fees as approved by the court, the remaining funds will be distributed to class members on a pro rata basis.
Separately, PharMerica will fund claims for documented out-of-pocket losses of up to $10 000 per class member. Eligible losses may include unreimbursed fraud or identity theft losses, professional fees, credit-related expenses, and other documented costs traceable to the data incident.
Credit Monitoring and Security Measures
All settlement class members are eligible to receive one year of Kroll Complete Monitoring. The monitoring services include:
- Credit monitoring
- Dark web monitoring
- Payday loan monitoring
- Social Security number scans
- Fraud consultation and identity theft restoration
- $1 million in identity theft insurance coverage
- Credit score reporting and real-time inquiry alerts
The settlement agreement also provides that PharMerica has adopted and will maintain certain business practice changes related to information security safeguards.
Implications for Pharmacy and Health Care Providers
The preliminary approval underscores ongoing legal exposure for pharmacy and health care entities following cybersecurity incidents involving PII and PHI. The court acknowledged the complexity and litigation risks associated with data breach class actions while recognizing the public interest in resolving such disputes through settlement.
The case now proceeds to the final approval stage, where the court will determine whether to certify the settlement class and grant final approval of the agreement.
References
- Lurry v PharMerica Corp, No. 3:23-cv-00297-RGJ-CHL (WD Ky 2026). Accessed February 27, 2026. https://www.govinfo.gov/content/pkg/USCOURTS-kywd-3_23-cv-00297/pdf/USCOURTS-kywd-3_23-cv-00297-1.pdf
- $5.3M PharMerica data breach class action settlement. Top Class Actions. February 20, 2026. Accessed February 27, 2026. https://topclassactions.com/lawsuit-settlements/open-lawsuit-settlements/5-3m-pharmerica-data-breach-class-action-settlement/
