One of the largest pharmacy chains in the United States, Rite Aid has agreed to a US$6.8 million settlement to resolve a class action lawsuit stemming from a data breach that compromised customer information. The settlement, which has received provisional approval from a federal judge, will compensate affected individuals for documented financial losses and reinforce the company’s cybersecurity measures. As part of the agreement, Rite Aid is not required to admit any wrongdoing.
The lawsuit, filed in the US District Court for the Eastern District of Pennsylvania, followed Rite Aid’s disclosure on June 6, 2024, that a cyber attacker had impersonated an employee to gain unauthorized access to the company’s business systems. The company reported detecting the breach within 12 hours and immediately launched an investigation to secure its systems and assess the potential impact on customer data. Subsequent findings revealed that the attacker had accessed information related to customer purchases and attempted purchases between June 6, 2017, and July 30, 2018. Exposed data included names, addresses, birthdates, and driver’s license numbers.
The breach first gained public attention when the ransomware group RansomHub released a sample of the allegedly stolen data. According to cybersecurity news outlet Bleeping Computer reports, the criminals claimed to have exfiltrated approximately 10 gigabytes of sensitive customer information, including rewards card numbers.
Under the terms of the settlement agreement, Rite Aid will establish a US$6.8 million settlement fund, which will be distributed to affected individuals based on the extent of their documented financial losses. Each claimant may be eligible to receive up to US$10,000 in compensation, provided they can demonstrate that their losses were directly linked to the data breach. Alternatively, claimants may opt for a pro-rata cash payment, which will be determined after covering administrative costs, attorney fees amounting to up to US$2.4 million, taxes, and other settlement expenses. The four class representatives in the case will each receive a payment of US$3,500.
To facilitate the claims process, Rite Aid will launch a dedicated website, RiteAidDataSettlement.com, where affected individuals can access more information about the breach and submit their claims. The company will also attempt to notify all impacted customers directly. US residents seeking compensation must submit their claim forms by July 7, either electronically or via postal mail, with the latter requiring a postmark by the deadline.
Any remaining funds left unclaimed 120 days after all distributions are completed will be donated to the Pennsylvania Interest on Lawyers Trust Account Board. This nonprofit organization provides civil legal assistance through grants to legal service organizations, pro bono programs, and law schools.
Rite Aid, which operates 1,300 stores across 15 states and employs approximately 31,000 individuals—including 4,000 pharmacists—has undergone significant financial restructuring in recent years. The company filed for Chapter 11 bankruptcy protection in October 2023 and emerged as a privately held entity in September 2024.
