HackingData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)IDENTITY_BASICHEALTH_BASICPIILowContained
BRISTOL-MYERS SQUIBB COMPANY
bd_269fcc165d95a33a · schema v1 · pii pii-v1
Full breach record for BRISTOL-MYERS SQUIBB COMPANY →Cencora, Inc. notified Bristol Myers Squibb Company and the Bristol Myers Squibb Patient Assistance Foundation of a data security incident discovered on Feb 21, 2024. Personal information including names, addresses, DOBs, health diagnoses, and medications was exfiltrated from Cencora's systems. Cencora engaged law enforcement and cybersecurity experts, offered 24 months of credit monitoring, and is reinforcing security protocols.
Vermont clock✗ VT AG >45 bday12 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_43fa729f230b98f7California State AGfiled 2024-05-17Verified
- bd_87020ead768c9765Indiana State AGfiled 2024-05-17Verified
- bd_c1f57c93d6a4ce22Delaware State AGfiled 2024-05-17Candidate
Source provenance
- Source URL
- https://ago.vermont.gov/document/2024-05-17-bristol-myers-squibb-company-and-bristol-myers-squibb-patient-assistance-foundation-data
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 17, 2024
- Raw hash
- 16f22a3aaae2add7a8bd7e1a1d23ef5f833cd5c2cfb12ed03a70e5feaa00417d
Reporting entity
- Name
- Cencoranorm: cencora
- Domain
- cencora.com
Victim entity
- Name
- BRISTOL-MYERS SQUIBB COMPANYnorm: bristol myers squibb
Incident
- Discovered
- Feb 21, 2024
- Materiality determined
- —
- Notification sent
- May 17, 2024
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICHEALTH_BASICPII
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- Assistance of law enforcement
- Third party
- via Cencora, Inc.
Compliance
- Time to disclose
- 12 weeks(86 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.