HackingData ExfiltratedCustomer Data InvolvedIDENTITY_BASICHEALTH_BASICLowContained
TheraCom, L.L.C.
bd_44a81119b0139a0d · schema v1 · pii pii-v1
Full breach record for TheraCom, L.L.C. →TheraCom, L.L.C., a mail-order specialty pharmacy, notified California residents that their personal information was potentially compromised in an incident discovered on February 21, 2024. Cencora, TheraCom's parent company, learned that data from its information systems had been exfiltrated. Affected data includes names, addresses, and medical treatment information. TheraCom engaged law enforcement and cybersecurity experts, contained the incident, and is offering 24 months of credit monitoring.
California clockDiscovered Feb 21, 2024 → Notified Oct 8, 2024230d ✗ CA 60-day late33 weeks discovery → filing
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_073498cf96e54a1cHHS OCRfiled 2024-10-08Candidate
- bd_63dfd4977ab58da4Vermont State AGfiled 2024-10-08Candidate
- bd_98adae3fe8cb269fMontana State AGfiled 2024-10-08Candidate
- bd_f966adb4daafa8a6Indiana State AGfiled 2024-10-08Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-593110
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Oct 8, 2024
- Raw hash
- b67ce77ff0c62655159f646bd65fccf922a7ccdc05c5d7d162f24414a7df0ebf
Reporting entity
- Name
- TheraCom, L.L.C.norm: theracom
Victim entity
- Name
- TheraCom, L.L.C.norm: theracom
Incident
- Discovered
- Feb 21, 2024
- Materiality determined
- —
- Notification sent
- Oct 8, 2024
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICHEALTH_BASIC
- Attack vector
- Unknown
- MITRE ATT&CK
- T1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Regulator citations
- Assistance of law enforcement
Compliance
- Time to disclose
- 33 weeks(230 days from discovery to filing)
- Compliance flags
- CA 60-day late · 230d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Feb 21, 2024→ Notified: Oct 8, 2024230d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.