HackingData ExfiltratedCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICFINANCIAL_ACCOUNTMediumContained
BRISTOL-MYERS SQUIBB COMPANY
bd_c1f57c93d6a4ce22 · schema v1 · pii pii-v1
Full breach record for BRISTOL-MYERS SQUIBB COMPANY →Cencora, Inc. notified Bristol Myers Squibb Company patients that on February 21, 2024, data was exfiltrated from Cencora's information systems. The incident potentially affected personal information including names, addresses, dates of birth, health diagnoses, and medications. Cencora took containment steps, engaged law enforcement and cybersecurity experts, and is offering 24 months of credit monitoring through Experian. No evidence of misuse was found at the time of notification.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_269fcc165d95a33aVermont State AGfiled 2024-05-17Verified
- bd_43fa729f230b98f7California State AGfiled 2024-05-17Verified
- bd_87020ead768c9765Indiana State AGfiled 2024-05-17Verified
Source provenance
- Source URL
- https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2024/05/BMS_L01_SAS_1.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 17, 2024
- Raw hash
- 1bc40aa57eb3ab9a9bdba6aac41b53af5d131d06e2ae18ec605e796ae0adb6a4
Reporting entity
- Name
- Cencoranorm: cencora
- Domain
- cencora.com
Victim entity
- Name
- BRISTOL-MYERS SQUIBB COMPANYnorm: bristol myers squibb
Incident
- Discovered
- Feb 21, 2024
- Materiality determined
- —
- Notification sent
- May 17, 2024
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Regulator citations
- assistance of law enforcement
Compliance
- Time to disclose
- 12 weeks(86 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.