$6.8M Rite Aid Settlement Ends Data Breach Class Action Lawsuit

New to ClassAction.org? Read our Newswire Disclaimer

Rite Aid has agreed to pay $6.8 million to settle a proposed class action lawsuit over a 2024 data breach that impacted around 2.2 million people.

Don’t miss the next class action settlement deadline. Sign up for ClassAction.org’s free weekly newsletter.

The deal, which was preliminarily approved by the court on March 4, 2025, covers all United States residents whose personal information was compromised or potentially compromised in the Rite Aid data breach, including individuals who received notice of the incident.

The official website for the deal has yet to go live but can be found at RiteAidDataSettlement.com. To receive a Rite Aid settlement payout, you must file a timely, valid claim form online or by mail.

ClassAction.org will update this page when the official Rite Aid settlement website goes live. 

Class members can submit a Rite Aid settlement claim form to receive up to $10,000 in reimbursement for documented losses incurred “more likely than not” as a result of the Rite Aid data breach, court documents say. Claims for documented losses must be submitted with supporting evidence, such as credit card statements, bank statements, invoices, telephone records, screenshots or receipts.

Alternatively, consumers may file a claim for a pro-rated cash payment. The actual amount each class member will receive will vary depending on the number of approved claims submitted, court documents state.

Also as part of the class action settlement, Rite Aid has agreed to implement certain cybersecurity enhancements. The class action lawsuit attributed the Rite Aid cyberattack to the pharmacy chain’s allegedly inadequate data security measures.

According to the initial Rite Aid class action lawsuit, the breach was discovered around June 6, 2024, after an unknown third party allegedly impersonated a company employee to gain access to the pharmacy chain’s business systems.

Related Reading: Rite Aid Data Breach Lawsuit Says 2.2 Million People Impacted by 2024 Cyberattack

The class action suit claimed the unauthorized actor stole consumers’ names, addresses, dates of birth and driver’s license numbers or other forms of government-issued ID presented at the point of purchase between June 6, 2017 and July 30, 2018.

Settlement funds from the $6.8 million deal will be distributed to class members after the deal receives final approval from the court and all appeals are resolved. A final approval hearing has been scheduled July for 17, 2025.

Learn all about the legal process: What is a class action lawsuit?