Quick Answer: PharMerica has agreed to a $5.275 million settlement over a 2023 ransomware attack that exposed the personal and health data of nearly 5.8 million people. If you received a breach notice, you may be eligible for up to $10,000 for documented losses — or a proportional cash payment even if you had no out-of-pocket losses. The claim deadline is April 27, 2026.
In March 2023, a ransomware group called Money Message broke into PharMerica’s systems and stole 4.7 terabytes of data — the records of nearly 5.8 million patients, including Social Security numbers, medication histories, and health insurance information. Now the company has agreed to pay $5.275 million to settle the resulting class action lawsuit.
PharMerica is one of the largest pharmacy services companies in the United States, providing medications primarily to nursing homes, assisted living facilities, and other long-term care settings. The people whose data was stolen weren’t just online shoppers — many were elderly, medically vulnerable patients who had no reason to suspect their health records would end up in the hands of a criminal ransomware organization.
Claiming money you are owed is one good day. What you do over the following year is what actually changes your position.
In the latest issue (Oct 16): The check that looks like a scam may be real
Each weekday I send one short email: one story that caught my attention, why it might matter to you, and one manageable thing you can do with it.
Free. I sell nothing. Unsubscribe any time.
If you received a notice of this breach, here’s what the settlement offers and how to file before the deadline.
What Was Stolen in the PharMerica Breach
According to HIPAA Journal, the breach affected 5,815,591 individuals. The data stolen included:
- Full names and addresses
- Dates of birth
- Social Security numbers
- Medication information and prescription records
- Health insurance information
This Was Not a Minor Breach: The combination of Social Security numbers, health insurance information, and medication records creates significant identity theft risk — especially for older adults on fixed incomes. This data type is particularly valuable to fraudsters because health insurance fraud and medical identity theft can go undetected for years.
The breach was discovered on March 14, 2023, when PharMerica and its parent company BrightSpring identified suspicious activity on their systems. The ransomware group Money Message had accessed the systems on March 12-13, 2023 — and then published some of the stolen data on its own website to pressure PharMerica into paying a ransom.
What the Settlement Pays
Option 1: Documented Loss Claims (Up to $10,000)
If you experienced actual financial harm — unauthorized charges, costs to freeze your credit, fees paid to a professional to help with identity theft recovery, or other out-of-pocket losses — you can claim up to $10,000 with documentation. This requires third-party documentation; self-prepared records alone won’t be sufficient.
Option 2: Cash Payment (No Documentation Required)
If you received a breach notice but had no documented losses, you can still file a claim for a proportional cash payment from the settlement fund. The exact amount per person depends on how many valid claims are filed — the more people who file, the smaller each individual share.
Option 3: Free Credit Monitoring
All class members can enroll in one year of credit monitoring through Kroll Complete Monitoring, which includes credit monitoring, dark web monitoring, Social Security number scans, fraud consultation, identity theft restoration services, and $1 million in fraud and identity theft insurance.
Your Social Security number and medication records don’t expire. The damage from this kind of breach can show up years from now — file the claim even if nothing has gone wrong yet.— Steve Rhode
Key Deadlines — Do Not Miss These
Dates to Know
- April 13, 2026 — Objection/exclusion deadline
- April 27, 2026 — Claim filing deadline
- May 12, 2026 — Final approval hearing
What Happens If You Miss It
- You lose your right to file for any compensation
- You may still be bound by the settlement
- You cannot sue PharMerica separately over this breach
How to File a Claim
- Visit the official settlement website: PMCSettlement.com or file at forms.ksacms.com
- Submit your claim form with any supporting documentation for out-of-pocket losses
- For questions, contact the settlement administrator: Kroll Settlement Administration LLC at 833-754-6609
- File before April 27, 2026
File Even If Nothing Happened Yet: Many victims of data breaches don’t experience fraud immediately — it can take months or years for stolen Social Security numbers and health records to be weaponized. Filing a claim now preserves your right to compensation. Sitting it out means you give up that right permanently if the settlement is approved.
Who Is Eligible
- You received an official notice from PharMerica about this March 2023 data breach
- You are a U.S. resident
- Your data was included in PharMerica’s systems at the time of the breach
- People who did not receive a breach notice (check your records — it may have been mailed)
- PharMerica employees and their family members
Key Takeaways
- 5.8 million people had their Social Security numbers, health insurance info, and medication records stolen in a March 2023 ransomware attack on PharMerica
- $5.275 million settlement — up to $10,000 for documented losses, proportional cash payment for everyone else
- Free one-year credit monitoring available through Kroll for all class members
- Claim deadline: April 27, 2026 — missing it forfeits your right to compensation
- File at PMCSettlement.com or contact Kroll at 833-754-6609
Frequently Asked Questions
Who is eligible for the PharMerica data breach settlement?
Anyone in the United States who received official notice that their personal information was compromised in the March 2023 PharMerica data breach is eligible to file a claim. The breach affected approximately 5.8 million individuals whose records were held by PharMerica’s pharmacy services systems.
How much money can I get from the PharMerica settlement?
Class members with documented out-of-pocket losses related to fraud, identity theft, or breach-related expenses can claim up to $10,000. Class members without documented losses can still receive a proportional cash payment from the $5.275 million fund — the exact amount depends on the number of valid claims filed. All class members can also enroll in one year of free credit monitoring through Kroll.
What is the deadline to file a PharMerica settlement claim?
The claim deadline is April 27, 2026. The objection and exclusion deadline is April 13, 2026. The final court approval hearing is scheduled for May 12, 2026. Missing the claim deadline means forfeiting your right to any compensation from this settlement.
What data was stolen in the PharMerica breach?
The Money Message ransomware group stole approximately 4.7 terabytes of data including names, addresses, dates of birth, Social Security numbers, medication information, and health insurance information belonging to approximately 5.8 million individuals. This data is especially sensitive because it combines health records with identity information.
Where do I file a PharMerica settlement claim?
File your claim at the official settlement website, PMCSettlement.com, or through the claims portal at forms.ksacms.com. You can also reach the settlement administrator, Kroll Settlement Administration LLC, at 833-754-6609 for assistance.
Sources: Top Class Actions; HIPAA Journal — PharMerica Breach Details; HIPAA Journal — Settlement; Bleeping Computer — Ransomware Attack
Dealing With Debt? Understanding your options is the first step. See how all your debt relief options compare — including ones most sites won’t tell you about. The Find Your Path quiz gives a recommendation based on your actual numbers, and the Scam-O-Meter checks any company’s complaint history before you sign. Federal Reserve research shows bankruptcy filers recover faster than those who don’t file.
