Cencora Notifies Patients of Data Breach Affecting Personal Health Information

Cencora, Inc. and its affiliate Lash Group have begun notifying individuals of a data breach that occurred last year, potentially affecting their personal health information.

Cencora, Inc. is a company that collaborates with pharmaceutical companies, pharmacies, and healthcare providers to facilitate access to therapies. It offers services such as drug distribution, patient support services, business analytics, and technology solutions to ensure efficient healthcare delivery and support patient care programs.

Despite the breach occurring in February 2024, the company only recently started circulating notices to the impacted individuals.

Discovery

The data breach was discovered on February 21, 2024, when Cencora detected unauthorized activity within its information systems, which indicated that data had been exfiltrated. This data included sensitive personal information.

Cencora swiftly took containment steps and launched an investigation with the help of law enforcement, cybersecurity experts, and external counsel. The incident was reported to the U.S. Securities and Exchange Commission (SEC) in a Form 8-K filing on February 27, 2024.

Incident details

According to the notices sent out, the data breach potentially exposed personal information such as:

• First and last names
• Addresses
• Dates of birth
• Health diagnoses
• Medications and prescriptions

Despite the breach, Cencora stated that there is no evidence to suggest that the information has been publicly disclosed or misused for fraudulent purposes.

Cencora says it confirmed the specific details of the compromised information on April 10, 2024. Since the discovery, the company has worked to investigate the breach and reinforce its cybersecurity measures, collaborating with cybersecurity experts to enhance their systems and protocols to prevent similar incidents in the future.

Support for impacted patients

To mitigate potential risks, Cencora is offering affected individuals access to Experian IdentityWorks credit monitoring and remediation services for 24 months at no charge. These services will provide alerts for any changes to credit files and offer proactive fraud assistance, including identity restoration if needed.

Cencora advises affected individuals to sign up for the offered credit monitoring services to receive alerts about any attempts to use personal information fraudulently and carefully monitor bank, credit card, and other financial statements for any unauthorized transactions.