Rite Aid pharmacy customers affected by the June 2024 ransomware breach had the opportunity to file claims for compensation, but the deadline to submit new claims closed on July 7, 2025. If you were among the 2.2 million customers whose personal data—including names, addresses, payment information, and pharmacy records—was compromised in the attack, you may have already received compensation through the $6.8 million settlement finalized on July 17, 2025. For those who missed the deadline or are unsure about their eligibility, understanding what options existed and what happened with the settlement can clarify whether you were owed money and how much typical class members received.
The settlement was distributed pro rata to class members who either submitted documented proof of damages or opted into the automatic payment pool. Customers who suffered unauthorized charges, purchased credit-monitoring services, or paid for professional assistance with identity restoration could claim those direct costs, up to a cap of $10,000 per person. Those without documented expenses still received a share of the remaining settlement pool—an average of approximately $38.28 per person—based on the total number of eligible class members, with California residents eligible for higher statutory damages of approximately $76 or more due to state privacy law requirements.
Table of Contents
- What Was the Rite Aid Data Breach and Who Qualified for Claims?
- How Much Could Claimants Receive and What Were the Payment Tracks?
- Timeline and Critical Dates: When Claims Had to Be Filed
- Claim Submission: What Documentation Was Required and When?
- What Happened to Unclaimed Funds and Settlement Limitations?
- Settlement Administrator and Payment Processing
- Why the Deadline Matters and What It Means for Late Claimants
What Was the Rite Aid Data Breach and Who Qualified for Claims?
On June 6, 2024, rite Aid Corporation disclosed a significant ransomware attack that exposed the personal and health information of approximately 2.2 million customers across the United States. The breach compromised sensitive data including full names, home addresses, phone numbers, dates of birth, Social Security numbers (in some cases), payment information, and pharmacy records containing details about prescriptions and medical conditions. The attack affected customers from 2018 through the discovery of the breach in 2024, spanning years during which customers shopped or filled prescriptions at Rite Aid locations. To qualify for the settlement in the case Margaret Bianucci v.
Rite Aid Corporation (filed in the U.S. District Court for the Eastern District of Pennsylvania), customers had to have been U.S. residents with a Rite Aid account during the affected period whose personal data was compromised in the breach. Unlike some data breach settlements that limit compensation to those who can prove specific financial harm, this settlement included a pro rata track for customers who experienced data exposure itself—a recognition that privacy violations carry inherent value even without documented out-of-pocket losses. Pharmacy breach settlements are particularly sensitive because they involve health information, making courts more willing to compensate exposure-only claims.
How Much Could Claimants Receive and What Were the Payment Tracks?
The settlement allocated $6.8 million to be distributed among eligible class members through two primary payment tracks. The first track was a “documented damages” path where claimants could submit proof of direct financial losses stemming from the breach: bank statements showing unauthorized charges, receipts for credit-monitoring subscriptions they purchased, invoices for legal services or identity-restoration services, or notary fees. These documented expenses could be reimbursed dollar-for-dollar, up to an individual cap of $10,000 per claimant. The second track was a pro rata distribution available to any class member who opted in without submitting documentation.
This track required no proof of specific harm and was designed to ensure that all 2.2 million affected customers received some compensation regardless of whether they could document out-of-pocket expenses. Based on the final claims data, 69,451 people submitted claims, resulting in an average payout of approximately $38.28 per class member through the pro rata pool. However, this figure masks significant variation: California residents qualified for approximately $76 or more per person due to California’s privacy statutes, which allow statutory damages in addition to actual damages. A limitation of the pro rata track was that it assumed all class members suffered equal harm, even though some customers’ exposure was more extensive than others (for example, a customer whose full Social Security number was stolen faced greater risk than someone whose home address was exposed).
Timeline and Critical Dates: When Claims Had to Be Filed
The settlement’s preliminary approval by the court occurred on March 4, 2025, after which the settlement administrator, Kroll Settlement Administration LLC, opened the claim window. The critical deadline for submitting claims was July 7, 2025—this date was firm, and no claims filed after that date were accepted. Customers who discovered the breach late, failed to notice the claim notice, or delayed submitting paperwork missed the opportunity entirely. The final approval of the settlement followed on July 17, 2025, confirming the settlement’s validity and triggering the payment timeline.
After final approval on July 17, 2025, the settlement administrator had 30 days to distribute payments to eligible claimants. This meant that approved claims should have been paid by approximately August 17, 2025. The settlement administrator’s contact information was provided to claimants for questions about status: Kroll Settlement Administration LLC could be reached at 833-421-7672, and the settlement website riteaiddatasettlement.com provided claim tracking and documentation requirements. One important warning: claimants who submitted documentation but did not receive payment confirmation within 30 days should have contacted the administrator immediately, as payment delays sometimes trigger claims of misadministration that can complicate disputes.
Claim Submission: What Documentation Was Required and When?
For claimants choosing the documented-damages track, the requirements varied by type of loss. Those claiming unauthorized charges needed to provide bank statements or credit card statements showing the fraudulent transactions, along with evidence that they reported the fraud to their financial institution or credit card company (this created a paper trail proving the charge was unauthorized, not just a mistaken purchase). Customers who purchased credit-monitoring services—such as Equifax, Experian, or TransUnion identity-protection plans—needed to submit receipts or account statements showing the subscription cost and dates of service. For professional services like credit counseling, identity-theft recovery support, or notary services, claimants needed to submit itemized invoices on letterhead or official documentation.
The challenge with this track was that not all customers kept thorough records, particularly for incidents that occurred years before the breach was discovered. A customer who purchased credit monitoring in 2020 due to an unrelated identity concern might not have saved the receipt by 2024, making it impossible to definitively link the expense to the Rite Aid breach. The settlement required claimants to prove that their damages were caused by the breach specifically, not by some other source of exposure, which created evidentiary burdens that some customers could not meet. For this reason, the pro rata track without documentation requirements became attractive to many claimants, even though it paid less on average.
What Happened to Unclaimed Funds and Settlement Limitations?
The settlement allocated up to 35% of the $6.8 million fund to attorney fees and administrative costs, meaning the actual distribution to class members was capped at a maximum of $4.42 million (65% of the total). After deducting confirmed claims, any unclaimed funds were subject to cy pres distribution (payment to related charitable or legal organizations) rather than reverting to Rite Aid, which was a significant negotiating point that class counsel would have emphasized. However, the details of cy pres recipients were determined by the court and typically directed funds to organizations focused on data privacy, consumer protection, or cybersecurity education.
A major limitation of the settlement was the individual cap of $10,000 on documented damages, which meant that customers who suffered truly catastrophic harm—for example, someone whose identity was stolen and used to open multiple credit accounts requiring years of legal action to resolve—could not recover their full costs. The settlement also did not address the value of the pharmacy data itself, which contained sensitive health information worth significantly more on the dark web than generic personal data; the settlement treated a prescription record breach the same as an address-only breach in terms of eligibility and compensation. Additionally, customers who declined to participate in the class action (or who never learned about it) had already lost the right to pursue their own individual lawsuits due to the settlement’s class action status, making this a one-time-only compensation opportunity that expired completely on July 7, 2025.
Settlement Administrator and Payment Processing
Kroll Settlement Administration LLC handled all claim intake, verification, and payment distribution for the settlement. As a specialized settlement administration firm, Kroll maintained the claim website, processed documentation submissions, and coordinated with claimants regarding missing information or claims requiring additional verification. The administrator’s phone line (833-421-7672) was available for status inquiries, questions about claim eligibility, and technical support with online claim submission.
Payment distribution went directly to the bank accounts or mailing addresses claimants provided during submission. Because the settlement involved sensitive health and financial information, the administrator was required to verify claimant identity before processing payments, which occasionally meant requests for additional documentation (such as a copy of a government-issued ID) to ensure that someone other than the legitimate class member was not intercepting the payment. Claims that could not be verified or that remained incomplete after follow-up contact by the administrator were denied, with claimants losing their right to compensation if they did not respond to verification requests within specified timeframes.
Why the Deadline Matters and What It Means for Late Claimants
The July 7, 2025 deadline represented a hard cutoff enforced by federal court order. Unlike some settlements that allow late claims under exceptional circumstances, this settlement offered no appeals process or exception window for claimants who missed the deadline. A customer who submitted a claim on July 8, 2025, or any day after, would have found their claim rejected outright by the administrator’s systems and could not resubmit it. This structure is standard in class action settlements precisely because it provides finality and prevents the defendant (Rite Aid) and settlement fund from facing open-ended liability.
For customers who believed they were eligible but failed to file, the options after July 7, 2025 were extremely limited. Filing an individual lawsuit against Rite Aid would be barred by the class action settlement, which typically includes a release clause preventing duplicate claims. Some customers attempted to pursue claims against their own financial institutions for fraudulent charges or against credit-card companies for unauthorized purchases, but these claims would stand separately from the Rite Aid settlement and depended on specific circumstances and transaction details. The practical reality was that missing the settlement deadline meant forfeiting compensation entirely, with no recourse except to monitor one’s credit and identity for the remainder of the time window during which stolen data might be used (typically within 3–5 years of a breach, according to cybersecurity research).
Sources
- Rite Aid Data Breach and Bankruptcy – You May Be Entitled to Compensation on OpenClassActions.com — investigation page, including who is still being signed up.
You Might Also Like
- Walgreens Prescription Privacy Fee or Refund Claims: Potential Options for Pharmacy Customers
- Rite Aid Pharmacy Records Class Action Claims: How Pharmacy Affected Customers Can Review Their Options
- Sam’s Club Delivery Fee Fee or Refund Claims: Potential Options for Club Members