If you shop at Rite Aid, you could be owed as much as $10,000 from a recent $6.8 million class-action settlement.
In a complaint filed in July 2024, plaintiffs alleged the pharmacy chain failed to protect them from a cyberattack that exposed the personal identifiable information, or PII, of over 2 million customers.
The U.S. District Court for the Eastern District of Pennsylvania granted preliminary approval for the settlement in March, with a final hearing slated for July 17, 2025.
Find out if you qualify for payment, how much you could get and how you can file your claim.
What is the class action suit against Rite Aid about?
According to court filings, a hacker with the ransomware group RansomHub was able to access Rite Aid’s computer systems on June 6, 2024.
The collected data included names, addresses, dates of birth and driver’s license numbers. According to the pharmacy chain, “no Social Security numbers, financial information or patient information was impacted by the incident.”
Shield yourself with identity theft protection
Rite Aid notified affected customers several weeks later, in July 2025, offering them free credit monitoring and identity theft protection services for 12 months.
Several lawsuits claiming the response was inadequate were consolidated into a single class action suit, Bianucci v. Rite Aid Corporation. A U.S. District Court provisionally approved a settlement with the drugstore in March.
The suit claimed the breach was a direct result of Rite Aid’s failure to implement adequate cybersecurity procedures. It had been the victim of a similar breach in 2023 and, given that it works within the healthcare industry, “it was foreseeable that [Rite Aid] would be the target of a cyberattack.”
The chain has been facing financial hardship, shuttering more than 700 locations since filing for bankruptcy and restructuring in October 2023.
It denied any wrongdoing in the case, maintaining it agreed to settle to avoid the “time, risk, and expense of defending protracted litigation.”
Rite Aid did not respond to CNBC Select’s request for additional comment.
Who is eligible to receive money from the settlement?
Rite Aid customers in the U.S. whose personal information was compromised or potentially compromised in the June 2024 data breach are eligible to be class members in the suit.
Eligible customers should have received a data breach notification from Rite Aid.
If you didn’t receive a notice but believe you were impacted by the breach, you can contact the Settlement Administrator or call them at 833-421-7672.
Take action to protect your identity
Offers in this section are from affiliate partners and selected based on a combination of engagement, product relevance, compensation, and consistent availability.
Plans from $9 to $25 per month, billed annually
Protects against identity theft, financial fraud, spam calls, online theft, scam websites, viruses and malware. Offers VPN, 3-credit bureau monitoring, password manager and instant credit lock.
How much money can you get from Rite Aid?
The $6.8 million settlement will cover payments to class members, as well as attorneys’ fees, administrative costs, taxes and special monetary awards to class representatives.
The amount a specific class member can receive depends on whether they have proof they spent money or incurred losses relating to the data breach.
If you have evidence, you may be eligible for a documented loss payment of up to $10,000. You’ll need supporting documentation, like:
- Account statements showing unauthorized charges.
- Receipts for professional fees related to identity theft.
- Receipts for credit monitoring services purchased after June 6, 2024.
- Other relevant documents proving your expenses.
Without documentation, you can still claim a flat cash payment, but the amount will depend on the total number of valid claims and how much of the settlement fund remains after valid documented loss payments are disbursed.
Funds should go out within 30 days of the final approval hearing on July 17, 2025, but they may be delayed by appeals or injunctions.
How do I file a claim?
You can submit your claim online via the official Rite Aid settlement site or download a PDF claim form to mail to the Settlement Administrator at:
Rite Aid Data Breach Settlement Administrator
c/o Kroll Settlement Administration LLC,
P.O. Box 225391, New York, NY 10150-5391
The deadline to submit a settlement claim form is July 7, 2025.
The deadline to object to the lawsuit or have yourself removed as a class member in order to file your own suit is June 6, 2025.
How to protect yourself from identity theft
No one who shares personal information with third parties —whether it’s a drugstore, a bank or a phone company — is impervious to identity theft. In 2024, the Federal Trade Commision website alone received more than 1.1 million reports of identity theft.
What consumers can do is consider an identity theft protection service, which scours social media, the Internet and the dark web for your personal information and alerts you about any suspicious activity. It can also provide a VPN, monitor your kids’ online gaming for cyberbullying and provide identity restoration services.
If you’ve been exposed in a data breach, identity protection services are the first line of defense. Many come with identity theft insurance, which reimburses you for legal fees, lost wages and other expenses related to the cyberattack.
Other options include downloading a password manager or subscribing to a credit monitoring service, which tracks your credit reports for signs of unusual activity or fraud. Both of these tools are offered individually or as part of a larger identity theft protection plan.
Data breach FAQ
Is the Rite Aid data breach settlement real?
Yes, in June 2024, personal information from millions of Rite Aid customers was accessed by RansomHub. Several lawsuits claimed the drugstore chain failed to protect its customers and did not notify them of the incident promptly. While it admitted no wrongdoing, Rite Aid ultimately agreed to settle with the plaintiffs in a $6.8 million merged class action suit. Potential victims of the cyberattack can now file a claim for their share.
What is a data breach?
A data breach occurs when unauthorized parties access sensitive information, including both personal information — date of birth, Social Security number, address — and corporate information, like company finances or customer records.
How can I prevent a data breach?
While it’s almost impossible to guarantee you PII will never get hacked, having strong passwords that you change frequently can help, especially with your most frequently used and sensitive accounts. An identity theft protection service will notify you of any misuse of your credentials, even before a data breach has been announced publicly.
Being aware of common web and phone scams and taking reasonable precautions can also go a long way toward protecting your info.
How much can I get in the Rite Aid data breach settlement
Rite Aid has agreed to a $6.8 million settlement, with class members who can document loss eligible for up to $10,000 in compensation.
Customers who can’t document loss are still eligible for payment, but only after documented loss payments are sent out and attorneys’ fees, administrative costs, taxes and monetary awards to class representatives are paid.
Subscribe to the CNBC Select Newsletter!
Money matters — so make the most of it. Get expert tips, strategies, news and everything else you need to maximize your money, right to your inbox. Sign up here.
Why trust CNBC Select?
At CNBC Select, our mission is to provide our readers with high-quality service journalism and comprehensive consumer advice so they can make informed decisions with their money. Every article is based on rigorous reporting by our team of expert writers and editors with extensive knowledge of financial products. While CNBC Select earns a commission from affiliate partners on many offers and links, we create all our content without input from our commercial team or any outside third parties, and we pride ourselves on our journalistic standards and ethics.
Catch up on CNBC Select’s in-depth coverage of credit cards, banking and money, and follow us on TikTok, Facebook, Instagram and Twitter to stay up to date.
Editorial Note: Opinions, analyses, reviews or recommendations expressed in this article are those of the Select editorial staff’s alone, and have not been reviewed, approved or otherwise endorsed by any third party.
