HackingHealthcareManufacturingHealthcareCapture Stored DataData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedDelayed DiscoveryIdentity (basic)Health (basic)PHILowContained

PFIZER INC.

bd_43fd3ad486c2c2b5 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Jun 7, 2024

To disclose

—

Affected

Not disclosed

Linked

3 filings

Confidence

73%

Full breach record for PFIZER INC. →8 incidents on file

Cencora, Inc. and its Lash Group affiliate, a third-party partner supporting Pfizer Inc.'s patient support programs, experienced a data exfiltration incident detected on February 21, 2024. Personal information including names, addresses, dates of birth, health diagnoses, and medications/prescriptions was potentially affected. On April 10, 2024, Cencora confirmed affected individuals. Cencora launched an investigation with law enforcement and cybersecurity experts and is offering 24 months of Experian credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Feb 21, 2024

Begins

Jun 7, 2024

Filed

This filing is one of 3 about the same incident.View merged incident

Part of CENCORA, INC. supply-chain incident (2024) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_6c49cd409f84490a2024-06-07Verified
Vermont State AGbd_e803596bb5c033cd2024-06-07Verified

Name: PFIZER INC.
norm: pfizer
Domain: pfizer.com

Name: PFIZER INC.
norm: pfizer
Domain: pfizer.com
Industry: Pharmaceutical
Industry: HealthcarellmManufacturingllm

Discovered: —
Breach occurred: Feb 21, 2024
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Health (basic)PHI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1041 Exfiltration Over C2 ChannelT1119 Automated Collection
Threat actor: External
Regulator citations: Notified California Office of the Attorney General
Third party: via Cencora, Inc. / Lash Group

During the incident: Cencora immediately took containment steps upon initial detection of the unauthorized activity
Commenced an investigation with the assistance of law enforcement, cybersecurity experts and outside lawyers
Providing free access to Experian IdentityWorksSM credit monitoring and remediation services for 24 months
Changes made: Working with cybersecurity experts to enhance our systems and information security protocols in an effort to prevent incidents like this from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGJun 7 · first

Vermont State AGJun 7 · first

California State AGJun 7 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-586568
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 7, 2024
Raw hash: e764797edad8cbc67f75b6119bb54316ba2b18b64d739d2f31f0b9c96c55cb0c

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityPFIZER INC.

Victim entityPFIZER INC.

IncidentUnauthorized Access

Stated responseCencora immediately took containment steps upon initial detection of the unauthorized activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov