Rite Aid Data Breach Settlement: $6.8M

Individuals whose personal information was compromised or potentially compromised in the Rite Aid data breach disclosed in June 2024, including those who received a notification letter.

To claim documented losses, class members must provide supporting materials such as credit card statements, bank statements, invoices, telephone records, receipts, or screenshots related to the breach.

Rite Aid has agreed to a $6.8 million class action settlement to resolve allegations that it failed to protect customer information during a cyberattack on June 6, 2024. According to the lawsuit, the retail pharmacy chain could have avoided the breach had it implemented stronger data security protocols. Plaintiffs also claim that Rite Aid did not notify affected individuals promptly, putting them at greater risk of fraud.

The compromised information reportedly includes names, mailing addresses, birth dates, and driver’s license numbers of affected customers.

While Rite Aid denies any wrongdoing, it agreed to settle the case and invest in improved security measures to help prevent future breaches.

Under the Terms of the Settlement

Eligible class members may choose between two forms of compensation:

• Documented Loss Payment: Those who experienced identity theft, fraud, or incurred costs directly tied to the data breach can receive up to $10,000. Reimbursement covers expenses like professional services, identity protection, fraudulent charges, or credit-related costs, provided adequate documentation is submitted.

• Cash Fund Payment: For class members without documented losses, a cash payment is available. The exact amount depends on the number of claims filed and the amount left after paying documented loss claims.

In addition to financial relief, Rite Aid has committed to enhancing its cybersecurity practices as part of the resolution.