HackingData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedIDENTITY_BASICHEALTH_BASICPIILowContained
GlaxoSmithKline Group of Companies
bd_ca960a961eac8c79 · schema v1 · pii pii-v1
Full breach record for GlaxoSmithKline Group of Companies →GlaxoSmithKline Group of Companies was affected by a data breach involving its third-party service provider, Cencora. Cencora learned on Feb 21, 2024 that data had been exfiltrated. Affected data included names, addresses, DOBs, health diagnoses, and medications. Lash Group, a partner, is notifying consumers and offering 24 months of credit monitoring via Experian. No evidence of fraud was found at the time of notice.
Vermont clock✗ VT AG >45 bday13 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_2e587918d883b471Delaware State AGfiled 2024-05-24Candidate
Source provenance
- Source URL
- https://ago.vermont.gov/document/2024-05-24-glaxosmithkline-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 24, 2024
- Raw hash
- e8c4f843bd6e4731b4483e5788533ae79de05179f25352119dc82953c3b27d0d
Reporting entity
- Name
- The Lash Group, LLCnorm: the lash
Victim entity
- Name
- GlaxoSmithKline Group of Companiesnorm: glaxosmithkline group of companies
Incident
- Discovered
- Feb 21, 2024
- Materiality determined
- —
- Notification sent
- May 24, 2024
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICHEALTH_BASICPII
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- Assistance of law enforcement
- Third party
- via Cencora
- Initial access
- supply_chain
Compliance
- Time to disclose
- 13 weeks(93 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.