Pharmaceutical Data Breach Affects Multiple Companies

Cencora, formerly AmerisourceBergen, suffered a cyberattack in February 2024. BleepingComputer reports that data belonging to some of the largest drug companies in the world was stolen in the pharmaceutical data breach.

Cencora disclosed the breach in a Form 8-K filing with the SEC shortly after it happened, but did not share any information regarding the incident’s impact on its clients.

On May 24, the California Attorney General’s office published a number of data breach notifications that were submitted in the previous few days, in which some of the largest pharmaceutical firms in the United States said their data was exposed in the February Cencora incident.

According to the notices, Cencora’s internal investigation confirmed that the full names, addresses, health diagnoses, medications, and prescriptions of customers had been exposed. 

The eleven firms impacted by the pharmaceutical data breach all used almost identical wording on their notifications. 

• Novartis Pharmaceuticals Corporation
• Bayer Corporation
• AbbVie Inc.
• Regeneron Pharmaceuticals, Inc.
• Genentech, Inc. (A member of the Roche Group)
• Incyte Corporation
• Sumitomo Pharma America, Inc.
• Acadia Pharmaceuticals Inc.
• GlaxoSmithKline Group
• Endo Pharmaceuticals Inc.
• Dendreon Pharmaceuticals LLC.

Cencora is offering two years of free identity protection and credit monitoring services through Experian. Recipients of the offer have until August 30, 2024, to sign up.

BleepingComputer contacted Cencora to learn more about the breach and the number of people impacted, but a spokesperson declined to provide additional details.