How to claim up to $10,000 from Rite Aid’s data breach settlement

If you shop at Rite Aid, you could be owed as much as $10,000 from a recent $6.8 million class-action settlement.

In a complaint filed in July 2024, plaintiffs alleged the pharmacy chain failed to protect them from a cyberattack that exposed the personal identifiable information, or PII, of over 2 million customers.

The  U.S. District Court for the Eastern District of Pennsylvania granted preliminary approval for the settlement in March, with a final hearing slated for July 17, 2025. 

Find out if you qualify for payment, how much you could get and how you can file your claim.

According to court filings, a hacker with the ransomware group RansomHub was able to access Rite Aid’s computer systems on June 6, 2024.

In a statement, Rite Aid said it shut down the unauthorized log-in within 12 hours. By then, however, RansomHub had grabbed PII on 2.2 million customers who had made purchases between June 6, 2017, and July 30, 2018.

The collected data included names, addresses, dates of birth and driver’s license numbers. According to the pharmacy chain, “no Social Security numbers, financial information or patient information was impacted by the incident.”

Rite Aid notified affected customers several weeks later, in July 2025, offering them free credit monitoring and identity theft protection services for 12 months.

Several lawsuits claiming the response was inadequate were consolidated into a single class action suit, Bianucci v. Rite Aid Corporation. A U.S. District Court provisionally approved a settlement with the drugstore in March.

The suit claimed the breach was a direct result of Rite Aid’s failure to implement adequate cybersecurity procedures. It had been the victim of a similar breach in 2023 and, given that it works within the healthcare industry, “it was foreseeable that [Rite Aid] would be the target of a cyberattack.”

The chain has been facing financial hardship, shuttering more than 700 locations since filing for bankruptcy and restructuring in October 2023.

It denied any wrongdoing in the case, maintaining it agreed to settle to avoid the “time, risk, and expense of defending protracted litigation.”

Rite Aid did not respond to CNBC Select‘s request for additional comment.

Rite Aid customers in the U.S. whose personal information was compromised or potentially compromised in the June 2024 data breach are eligible to be class members in the suit.

Eligible customers should have received a data breach notification from Rite Aid.

If you didn’t receive a notice but believe you were impacted by the breach, you can contact the Settlement Administrator or call them at 833-421-7672.

The $6.8 million settlement will cover payments to class members, as well as attorneys’ fees, administrative costs, taxes and special monetary awards to class representatives.

The amount a specific class member can receive depends on whether they have proof they spent money or incurred losses relating to the data breach.

If you have evidence, you may be eligible for a documented loss payment of up to $10,000. You’ll need supporting documentation, like:

• Account statements showing unauthorized charges.
• Receipts for professional fees related to identity theft.
• Receipts for credit monitoring services purchased after June 6, 2024.
• Other relevant documents proving your expenses.

Without documentation, you can still claim a flat cash payment, but the amount will depend on the total number of valid claims and how much of the settlement fund remains after valid documented loss payments are disbursed.

Funds should go out within 30 days of the final approval hearing on July 17, 2025, but they may be delayed by appeals or injunctions.

You can submit your claim online via the official Rite Aid settlement site or download a PDF claim form to mail to the Settlement Administrator at: 

Rite Aid Data Breach Settlement Administrator
c/o Kroll Settlement Administration LLC,
P.O. Box 225391, New York, NY 10150-5391

The deadline to submit a settlement claim form is July 7, 2025.

The deadline to object to the lawsuit or have yourself removed as a class member in order to file your own suit is June 6, 2025.

No one who shares personal information with third parties —whether it’s a drugstore, a bank or a phone company — is impervious to identity theft. In 2024, the Federal Trade Commision website alone received more than 1.1 million reports of identity theft.

What consumers can do is consider an identity theft protection service, which scours social media, the Internet and the dark web for your personal information and alerts you about any suspicious activity. It can also provide a VPN, monitor your kids’ online gaming for cyberbullying and provide identity restoration services.

If you’ve been exposed in a data breach, identity protection services are the first line of defense. Many come with identity theft insurance, which reimburses you for legal fees, lost wages and other expenses related to the cyberattack.

Other options include downloading a password manager or subscribing to a credit monitoring service, which tracks your credit reports for signs of unusual activity or fraud. Both of these tools are offered individually or as part of a larger identity theft protection plan.

At CNBC Select, our mission is to provide our readers with high-quality service journalism and comprehensive consumer advice so they can make informed decisions with their money. Every article is based on rigorous reporting by our team of expert writers and editors with extensive knowledge of financial products. While CNBC Select earns a commission from affiliate partners on many offers and links, we create all our content without input from our commercial team or any outside third parties, and we pride ourselves on our journalistic standards and ethics.

Catch up on CNBC Select’s in-depth coverage of credit cards, banking and money, and follow us on TikTok, Facebook, Instagram and Twitter to stay up to date.