PharMerica Will Pay at Least $5.2M to Settle Hack Lawsuit

Pharmacy services firm PharMerica will pay at least $5.2 million – plus millions more to enhance its security – as part of a preliminary class action settlement approved Monday by a Kentucky federal judge. The lawsuit stems from a 2023 hacking incident the company reported as affecting 5.8 million individuals.

See Also: 2023 Ransomware Preparedness: Key Findings, Readiness and Mitigation

The consolidated proposed class action litigation alleged that PharMerica acted negligently in collecting and storing class members’ private information.

Ransomware group Money Message took responsibility for a March 2023 attack on PharMerica, stealing 4.7 terabytes of the company’s data and leaking on its dark website multiple spreadsheet containing patient information (see: PharMerica Reports Breach Affecting Nearly 6 Million People).

That included patient name, address, date of birth, Social Security number, medications and health insurance information, according to the company’s breach notice.

It is unclear from court documents whether PharMerica paid a ransom demand and if so, how much. A Money Market spokesperson at Databreaches.net in 2023 said that there had been some negotiations between the parties, but the sides reached an impasse.

The nearly $5.3 million settlement fund will be used to pay all settlement administration costs, PharMerica’s past and future costs of data mining to confirm membership in the settlement class and half of the nearly $3.5 million requested by class counsel for attorney fees. The other half of the requested attorney fees will be paid directly by PharMerica, court documents said.

In addition to the settlement fund, PharMerica agreed to pay up to $10,000 per class member for claims of documented out-of-pocket expenses related to the incident.

PharMerica is a pharmacy services provider for a variety of healthcare facilities and programs nationwide. That includes operating 180 local and 70,000 backup pharmacies, and providing specialty pharmacy, home infusion and behavioral health services to about 3,100 long term care, senior living and other facilities.

The company’s last available quarterly report from 2017, filed shortly after private equity firm KKR bought it for $1.4 billion, described it as the second-largest institutional pharmacy services company in the United States, based on revenue and customer-licensed beds.

KKR has since merged PharMerica with BrightSpring Health Services to form a corporation with approximately $4.5 billion in annual revenue.

Court documents indicate that as part of the settlement considerations, PharMerica “has adopted, paid for, implemented and will maintain certain business practice changes related to information security to safeguard personal information on its systems.” The estimated value of these business practice changes is $2.54 million annually.

A final court approval hearing for the settlement is scheduled for May 12.