HackingHealthcareTechnologyHealthcareCapture Stored DataData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDHealth (basic)PIIMediumContained

Lash Group (affiliate of Cencora, Inc.)

bd_6f32468af1fe1054 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jun 20, 2024

To disclose

—

Affected

Not disclosed

Confidence

79%

Full breach record for Lash Group (affiliate of Cencora, Inc.) →2 incidents on file

On February 21, 2024, Cencora, Inc. discovered that data from its information systems had been exfiltrated. The incident involved Lash Group, a Cencora affiliate that had held personal information through a prior partnership with CareDx, Inc. Affected data may include names, addresses, dates of birth, Social Security Numbers, and diagnostic test indicators. Cencora notified CareDx on May 22, 2024. Affected individuals were offered 24 months of Experian IdentityWorks credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Feb 21, 2024

Begins

Jun 20, 2024

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: CareDx, Inc.
norm: caredx

Name: Lash Group (affiliate of Cencora, Inc.)
norm: lash group affiliate of cencora
Industry: HealthcarellmTechnologyllm

Discovered: —
Breach occurred: Feb 21, 2024
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDHealth (basic)PII
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1041 Exfiltration Over C2 ChannelT1119 Automated CollectionT1074 Data Staged
Threat actor: External
Third party: via Cencora, Inc. / Lash Group

During the incident: Immediately took containment steps upon initial detection of the unauthorized activity
Commenced an investigation with the assistance of law enforcement, cybersecurity experts and outside lawyers
Cencora notified CareDx of the incident on May 22, 2024
Offering 24 months of complimentary Experian IdentityWorks credit monitoring and remediation services at no charge
Changes made: Working with cybersecurity experts to reinforce our systems and information security protocols in an effort to prevent incidents like this from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-587245
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 20, 2024
Raw hash: a29e7fc0fe971afc422325ea84832ba7204d8ffe80c5136037374bd58e67c594

Reporting entityCareDx, Inc.

Victim entityLash Group (affiliate of Cencora, Inc.)

IncidentUnauthorized Access

Stated responseImmediately took containment steps upon initial detection of the unauthorized activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov