Custom Rx Shoppe Data Breach: A Ransomware Claim, No Lawsuit Yet
Reference Guide
Custom Rx Shoppe is an independent pharmacy in Whatcom County, Washington. On September 30, 2026 a ransomware group listed it on its leak site, claiming an attack the day before. As of October 16, 2026 the pharmacy has not publicly confirmed anything, no breach notice is on file with the Washington Attorney General, and no Custom Rx Shoppe data breach lawsuit has been filed. What exists is a lawyer investigation — not a case, not a settlement.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Has Actually Been Reported
Custom Rx Shoppe has served Whatcom County since 2003. It runs a retail counter, a compounding lab and a long-term care service that supplies nursing homes and assisted-living facilities, with free delivery across Whatcom, Skagit and Island counties. That mix means it may hold prescription and insurance records for retail customers and for residents of care facilities.
The only source for the Custom Rx Shoppe data breach so far is the attackers themselves. Ransomware.live, which tracks extortion sites, recorded the listing on September 30, 2026 and estimated the attack date as September 29, 2026. A ransomware group's listing is a claim, made to pressure the victim into paying. It does not prove what was taken, and as of October 16, 2026 no one has published which data — if any — was involved. Breachsense lists the leak size as “Unknown.”
Case details
No lawsuit has been filed that we can find. A search of CourtListener's federal docket archive for “Custom Rx Shoppe” returned zero results on October 16, 2026, and our own database of federal court filings since October 10, 2026 shows no case. State court in Whatcom County was not searched. The page that triggered most searches is a law-firm intake page published September 30, 2026, which says attorneys are “looking into whether a class action lawsuit can be filed.” That is recruitment for a possible case, not a case. If a complaint is filed, it will have a court and a case number; anything without both is still an investigation.
Status: Unconfirmed Claim, No Case, No Settlement
The next real signal is a notice from the pharmacy. Washington law (RCW 19.255.010) requires a business to notify affected Washington residents no more than thirty calendar days after it discovers a breach, and to notify the Attorney General within thirty days if more than 500 Washington residents are affected. The law allows delay at law enforcement's request or while the scope is determined, and the company has not said when it discovered anything. The Attorney General's breach directory is where a filing would appear; on October 16, 2026 its newest entries were dated September 11, 2026.
Who Could Be Affected
No one knows yet, because the pharmacy has not said what was accessed. The groups with records at a pharmacy like this are retail and compounding customers, residents of care facilities it supplies, and staff.
The practical test is your mail. Under Washington law the notice must list the types of personal information involved, the date of the breach and of its discovery, and the phone numbers of the major credit bureaus. If you get one, keep the letter and the envelope — it is your proof that you are affected if a case is ever filed or settled. A family member in a care facility may get the letter at the facility or through whoever handles their mail.
Is There Money? Not Now
Custom Rx Shoppe Breach Timeline
September 29, 2026 — Estimated Attack Date
Ransomware.live estimates the claimed attack on the pharmacy took place on this date. The pharmacy has not confirmed it.
September 30, 2026 — Leak-Site Listing
A ransomware group lists customrxshoppe.com on its extortion site. Threat-tracking sites pick it up; the leak size is listed as unknown.
September 30, 2026 — Lawyer Investigation Announced
A class action site publishes an intake page asking patients and staff to come forward. It says lawyers are investigating whether a suit can be filed.
October 16, 2026 — No Notice on File
The Washington Attorney General's breach directory shows no Custom Rx Shoppe entry, and the pharmacy's homepage carries no incident notice.
Now — No Lawsuit, No Settlement
No federal case could be found. There is no fund, no administrator, no claim form and no deadline.
Three Things to Watch For
A small pharmacy with an unconfirmed breach and patients in care facilities is an easy target for imposters:
“Claim your Custom Rx Shoppe settlement” links
There is no settlement and no claims site. A page or text asking for your Social Security number, prescription details or bank account to “register” is collecting data, not filing anything.
Calls to family members of care-facility residents
Long-term care patients are often older and their relatives handle the paperwork. A caller who names the pharmacy and asks for Medicare numbers or a “verification fee” is not from any court or administrator.
“Your data was found on the dark web — pay to remove it”
Leak-site listings are public, so scammers can cite them convincingly. No one can pay to delete stolen data, and a real breach notice never asks you for payment.
Custom Rx Shoppe Breach — Questions People Actually Ask
Short answers to the questions people ask most about this case.
Is there a Custom Rx Shoppe data breach lawsuit?
Not as of October 16, 2026. A federal docket search returned no case, and the only legal activity is a law-firm investigation announced September 30, 2026. If a complaint is filed, it will name a court and carry a case number.
Did Custom Rx Shoppe confirm a data breach?
No public confirmation as of October 16, 2026. The report comes from a ransomware group's leak-site listing recorded September 30, 2026, with an estimated attack date of September 29, 2026. Attackers' claims are often exaggerated, so treat it as unverified.
What data was exposed?
Unknown. Neither the pharmacy nor any regulator has listed the data types, and tracking sites list the leak size as unknown. A Washington breach notice must state the types of information involved, so a letter, if one comes, will answer this.
How many people were affected?
No number has been reported. A business must notify the Washington Attorney General if more than 500 Washington residents are affected; as of October 16, 2026 no Custom Rx Shoppe notice appears in the Attorney General's directory.
How can I check if I have been data breached?
For this incident, watch for a letter from the pharmacy and check the Washington Attorney General's breach directory. Reading your insurer's explanation-of-benefits statements for prescriptions you never filled is the most direct way to spot misuse of pharmacy records.
Is the data breach settlement legit?
For Custom Rx Shoppe there is no settlement, so any message about one is not real. Genuine settlements are announced by a court-appointed administrator with a case number and a court-approved notice — see our list of open class action settlements.
How much compensation will I get for a data breach?
Here, nothing today — there is no case and no fund. Payments only exist once a court approves a settlement, and the amount depends on the fund, the number of claimants and whether you can document losses.
What is worth doing right now?
Freeze your credit at all three bureaus — it is free and reversible. Watch your insurance statements for prescriptions you never received. Keep any letter from the pharmacy. You do not need to sign anything to stay eligible for a class action that might be filed later.
About This Information
- Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated
- $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Open Class Action SettlementsSettlements taking claims now, with deadlines
- Data Breach Settlement CalculatorWhat comparable breach settlements have paid per person
- Change Healthcare Data BreachThe ransomware attack that hit pharmacy claims nationwide
- Settlement Payout CalculatorEstimate a per-person share once a fund exists