HackingHealthcareHealthcareCapture Stored DataData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedDelayed DiscoveryPIIPHIIdentity (basic)Health (basic)LowContained

BRISTOL-MYERS SQUIBB COMPANY

bd_43fa729f230b98f7 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

May 17, 2024

To disclose

—

Affected

Not disclosed

Linked

6 filings

Confidence

80%

Full breach record for BRISTOL-MYERS SQUIBB COMPANY →6 incidents on file

Cencora, Inc. and its Lash Group affiliate reported that on February 21, 2024, data was exfiltrated from Cencora's information systems, including personal information of patients enrolled in Bristol Myers Squibb and BMS Patient Assistance Foundation programs. Potentially affected data included name, address, date of birth, health diagnosis, and medications/prescriptions. Cencora engaged cybersecurity experts, law enforcement, and outside counsel. Notification letters dated May 17, 2024 were sent to affected individuals with offers of 24-month Experian identity monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Feb 21, 2024

Begins

May 17, 2024

Filed

This filing is one of 6 filings about the same incident.View merged incident

Part of CENCORA, INC. supply-chain incident (2024) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Washington State AGbd_0adc553539a63fa52024-05-17Candidate
Vermont State AGbd_269fcc165d95a33a2024-05-17Verified by operator
Indiana State AGbd_87020ead768c97652024-05-17Verified by operator
Montana State AGbd_9b48ef7232105fe92024-05-17Verified

Show 1 more filing ↓

Delaware State AGbd_c1f57c93d6a4ce222024-05-17Verified by operator

Name: BRISTOL-MYERS SQUIBB COMPANY
norm: bristol myers squibb
Domain: bms.com

Name: BRISTOL-MYERS SQUIBB COMPANY
norm: bristol myers squibb
Domain: bms.com
Industry: Healthcarellm

Discovered: —
Breach occurred: Feb 21, 2024
Materiality determined: —
Notification sent: May 17, 2024
Affected individuals: Not disclosed
Data types: PIIPHIIdentity (basic)Health (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1041 Exfiltration Over C2 ChannelT1119 Automated CollectionT1074 Data Staged
Threat actor: External
Regulator citations: Notified California Office of the Attorney General
Third party: via Cencora, Inc. / Lash Group

During the incident: Immediately took containment steps upon initial detection of the unauthorized activity
Commenced an investigation with the assistance of law enforcement, cybersecurity experts and outside lawyers
Notified potentially affected individuals
Changes made: Working with cybersecurity experts to reinforce our systems and information security protocols in an effort to avoid incidents like this from occurring in the future
Providing access to Experian IdentityWorks credit monitoring and remediation services for 24 months at no charge
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Washington State AGMay 17 · first

Vermont State AGMay 17 · first

Indiana State AGMay 17 · first

Montana State AGMay 17 · first

Delaware State AGMay 17 · first

California State AGMay 17 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-585529
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 17, 2024
Raw hash: a7c923304ceafb203925ca3e58e1e202f647c04c0d12b23feb337ff0dd498bed

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityBRISTOL-MYERS SQUIBB COMPANY

Victim entityBRISTOL-MYERS SQUIBB COMPANY

IncidentUnauthorized Access

Stated responseImmediately took containment steps upon initial detection of the unauthorized activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov