Found an article.

https://www.hipaajournal.com/kroger-class-action-pharmacy-patient-data-disclosures/#:~:text=The supermarket chain%2C Kroger%2C is,parties such as Meta Platforms.

Having read it, this smells more like a legal firm that makes money from suing a shit ton of companies and occasionally being right ratherthan any real evidence of the patient data disclosure.