HackingHealthcareTechnologyHealthcareCapture Stored DataData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDHealth (basic)PIIMediumContained

CareDx, Inc.

bd_6f32468af1fe1054 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jun 20, 2024

To disclose

—

Affected

Not disclosed

Linked

2 filings

Confidence

79%

Full breach record for CareDx, Inc. →

On February 21, 2024, Cencora, Inc. discovered that data from its information systems had been exfiltrated. The incident involved Lash Group, a Cencora affiliate that had held personal information through a prior partnership with CareDx, Inc. Affected data may include names, addresses, dates of birth, Social Security Numbers, and diagnostic test indicators. Cencora notified CareDx on May 22, 2024. Affected individuals were offered 24 months of Experian IdentityWorks credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Feb 21, 2024

Begins

Jun 20, 2024

Filed

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Montana State AGbd_7e5575c4b353d0082024-06-20Verified

Name: CareDx, Inc.
norm: caredx

Name: CareDx, Inc.
norm: caredx
Industry: HealthcarellmTechnologyllm

Discovered: —
Breach occurred: Feb 21, 2024
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDHealth (basic)PII
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1041 Exfiltration Over C2 ChannelT1119 Automated CollectionT1074 Data Staged
Threat actor: External
Third party: via Cencora, Inc. / Lash Group

During the incident: Immediately took containment steps upon initial detection of the unauthorized activity
Commenced an investigation with the assistance of law enforcement, cybersecurity experts and outside lawyers
Cencora notified CareDx of the incident on May 22, 2024
Offering 24 months of complimentary Experian IdentityWorks credit monitoring and remediation services at no charge
Changes made: Working with cybersecurity experts to reinforce our systems and information security protocols in an effort to prevent incidents like this from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGJun 20 · first

California State AGJun 20 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-587245
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 20, 2024
Raw hash: a29e7fc0fe971afc422325ea84832ba7204d8ffe80c5136037374bd58e67c594

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityCareDx, Inc.

Victim entityCareDx, Inc.

IncidentUnauthorized Access

Stated responseImmediately took containment steps upon initial detection of the unauthorized activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov