American Associated Pharmacies
bd_026dc026d7edd520 · schema v1 · pii pii-v1
Full breach record for American Associated Pharmacies →Threat-actor claim — not a regulatory filing
This row is a claim by the ransomware group Embargo on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.
Source: Ransomware.live
Post text · scraped from the leak site
American Associated Pharmacies (AAP) is a member-owned cooperative of over 2,000 independent pharmacies working together as a cohesive network. AAP in partnership with its subsidiaries, Associated Pharmacies, Inc. (API), Arete Pharmacy Network, and AllyScripts, provides the tools and resources needed for members to improve their bottom line and differentiate themselves from competitors. AAP members not only receive savings on brand prescriptions, generic prescriptions and OTC products through the API warehouse and their negotiated prime vendor agreement, but they also receive negotiated competitive managed-care contracts through the Arete Pharmacy Network. In addition to offering solutions such as API and Arete Pharmacy Network, AAP provides members access to a full-service specialty pharmacy, AllyScripts, that allows pharmacies to retain their patients and compete in the growing specialty segment without the costly investment. AAP is able to provide its members with the support and customized solutions they need to succeed in the marketplace. - It seems AAP does not care about their data. AAP has paid 1.3 million for decrypt and owe another 1.3 million for 1.469 TB of their data.
J jump to incidentP pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
Nov 12, 2024
Claim posted
—
Corroborated · see linked filings
This record's own dates cannot anchor compliance clocks; see the linked filings.
Claim → filing
—
Compliance clock
Not assessable
Linked disclosures
Why this link?Regulatory filings (9) · sorted by filing gap
- Massachusetts State AGbd_c346f35887da0b7e2024-12-23 · +40dVerified by operator
- California State AGbd_5752d2fa56e1021f2025-11-12 · +364dVerified
- Maine State AGbd_6f03581859047e742025-11-12 · +364dCandidate
- Vermont State AGbd_740593241b9440ec2025-11-12 · +364dVerified
Show 5 more filings ↓Show fewer ↑up to 369d gap
- Montana State AGbd_a055985a15fb12b52025-11-12 · +364dVerified
- Nebraska State AGbd_c555b37ef9fc19ae2025-11-12 · +364dVerified by operator
- Indiana State AGbd_d85f7aee45798f062025-11-12 · +364dVerified by operator
- Washington State AGbd_fe8758ed5a20a1302025-11-12 · +364dVerified
- New Hampshire State AGbd_98c35631ecb481212025-11-17 · +369dVerified by operator
Filing propagation · 9 filings · 9 states
View merged incident ↗Pattern: first filing Dec 23 (MA), last Nov 17 (NH) — a 329-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
Source ceiling
- actor name
- victim claim
- ransom/leak status
- discovery date
- materiality
- notification
- affected count
- confirmed data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.
embargo
According to ransomware.live, Embargo is a Rust-based ransomware-as-a-service group that emerged in April 2024, primarily targeting US healthcare, manufacturing, and business services organizations using double extortion, assessed as a potential successor to BlackCat/ALPHV with over $34 million in ransom proceeds.