HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedPHIIdentity (basic)Health (basic)LowContained

AmerisourceBergen Specialty Group, LLC

bd_26040ffd59901089 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Oct 8, 2024

To disclose

—

Affected

Not disclosed

Linked

2 filings

Confidence

66%

Full breach record for AmerisourceBergen Specialty Group, LLC →2 incidents on file

AmerisourceBergen Specialty Group, LLC notified California residents of a data breach involving exfiltration of personal and health information. The incident occurred on February 21, 2024. Affected data includes names, addresses, dates of birth, medical treatment information, health insurance information, and medical record numbers. The company engaged forensic experts and law enforcement, contained the incident, and is offering 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Feb 21, 2024

Begins

Oct 8, 2024

Filed

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Vermont State AGbd_9eed335e8f1457442024-10-08Verified

Name: AmerisourceBergen Specialty Group, LLC
norm: amerisourcebergen specialty

Name: AmerisourceBergen Specialty Group, LLC
norm: amerisourcebergen specialty
Industry: Healthcarellm

Discovered: —
Breach occurred: Feb 21, 2024
Materiality determined: —
Notification sent: Oct 8, 2024
Affected individuals: Not disclosed
Data types: PHIIdentity (basic)Health (basic)
Attack vector: Unknown
MITRE ATT&CK: T1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified law enforcement

During the incident: Launched an investigation with the assistance of cyber security experts, law enforcement, and outside lawyers
Immediately took containment steps upon initial detection of the unauthorized activity
Reviewed the impacted data to determine whether personal information was compromised
Working with cybersecurity experts to reinforce systems and information security protocols
Changes made: Providing access to Experian IdentityWorks credit monitoring and remediation services for 24 months at no charge
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Vermont State AGOct 8 · first

California State AGOct 8 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-593111
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 8, 2024
Raw hash: efb54f9185bcd5c599e46ce849c08c1abaabd29e8ddfeaf46e0169d544a9ac2d

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityAmerisourceBergen Specialty Group, LLC

Victim entityAmerisourceBergen Specialty Group, LLC

IncidentUnknown

Stated responseLaunched an investigation with the assistance of cyber security experts, law enforcement, and outside lawyers

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov