HackingHealthcareHealthcareCapture Stored DataData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedDelayed DiscoveryPIIPHIIdentity (basic)Health (basic)LowContained

Lash Group (affiliate of Cencora, Inc.)

bd_43fa729f230b98f7 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

May 17, 2024

To disclose

—

Affected

Not disclosed

Confidence

80%

Full breach record for Lash Group (affiliate of Cencora, Inc.) →2 incidents on file

Cencora, Inc. and its Lash Group affiliate reported that on February 21, 2024, data was exfiltrated from Cencora's information systems, including personal information of patients enrolled in Bristol Myers Squibb and BMS Patient Assistance Foundation programs. Potentially affected data included name, address, date of birth, health diagnosis, and medications/prescriptions. Cencora engaged cybersecurity experts, law enforcement, and outside counsel. Notification letters dated May 17, 2024 were sent to affected individuals with offers of 24-month Experian identity monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Feb 21, 2024

Begins

May 17, 2024

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: BRISTOL-MYERS SQUIBB COMPANY
norm: bristol myers squibb
Domain: bms.com

Name: Lash Group (affiliate of Cencora, Inc.)
norm: lash group affiliate of cencora
Industry: Healthcarellm

Discovered: —
Breach occurred: Feb 21, 2024
Materiality determined: —
Notification sent: May 17, 2024
Affected individuals: Not disclosed
Data types: PIIPHIIdentity (basic)Health (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1041 Exfiltration Over C2 ChannelT1119 Automated CollectionT1074 Data Staged
Threat actor: External
Regulator citations: Notified California Office of the Attorney General
Third party: via Cencora, Inc. / Lash Group

During the incident: Immediately took containment steps upon initial detection of the unauthorized activity
Commenced an investigation with the assistance of law enforcement, cybersecurity experts and outside lawyers
Notified potentially affected individuals
Changes made: Working with cybersecurity experts to reinforce our systems and information security protocols in an effort to avoid incidents like this from occurring in the future
Providing access to Experian IdentityWorks credit monitoring and remediation services for 24 months at no charge
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-585529
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 17, 2024
Raw hash: a7c923304ceafb203925ca3e58e1e202f647c04c0d12b23feb337ff0dd498bed

Reporting entityBRISTOL-MYERS SQUIBB COMPANY

Victim entityLash Group (affiliate of Cencora, Inc.)

IncidentUnauthorized Access

Stated responseImmediately took containment steps upon initial detection of the unauthorized activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov