Cencora pharmaceutical reports cyberattack and data breach
Learn More
Cencora, formerly known as AmerisourceBergen, has reported a cybersecurity incident where unauthorized threat actors accessed and exfiltrated data from its corporate information technology systems. Censora is a major player in the pharmaceutical services sector, offers distribution and various solutions catering to doctors' offices, pharmacies, and animal healthcare.
Cencora became aware of the data exfiltration, which potentially included personal information and has engaged with law enforcement, external cybersecurity specialists, and legal advisors to conduct a thorough investigation.
No details are disclosed about the nature of the attack, data stolen or number of affected individuals.
Update - As of 20th of May 2024, Cencora reports the exposed data includes:
- Patient names
- Postal addresses
- Dates of birth
- Health diagnoses
- Medication details
The breached information was obtained through Cencora’s partnerships with various pharmaceutical companies.
The impacted companies include:
- Novartis Pharmaceuticals Corporation
- Bayer Corporation
- AbbVie Inc.
- Regeneron Pharmaceuticals, Inc.
- Genentech, Inc.
- Incyte Corporation
- Sumitomo Pharma America, Inc.
- Acadia Pharmaceuticals Inc.
As of 1st of August 2024, Cencora has notified over 1.43 million individuals across the United States that their personal and protected health information was compromised.
Despite the immediate and response to the cyberattack, Cencora has stated that it has not yet ascertained the potential material impact of the incident on its financial standing or operational capabilities. The company's claims that there is no evidence to suggest any connection between this cyberattack and the recent ransomware attack on Optum Change Healthcare, which has caused significant disruptions in pharmaceutical billing systems.
As of now, there has been no claim of responsibility for the recent cyberattack on Cencora by any ransomware gangs, nor has there been additional information regarding the identity of the perpetrators behind the breach
