CENCORA, INC.

Cencora, Inc. filed an 8-K/A amending its February 27, 2024 disclosure of a cybersecurity incident discovered on February 21, 2024, in which data was exfiltrated from its information systems. Subsequent investigation confirmed exfiltrated data included PII and PHI, most of which is maintained by a Company subsidiary providing patient support services. The Company has notified affected parties and regulators, believes the incident is contained, and reports no evidence of public disclosure of the data.

Cencora, Inc. notified Vermont AG of a data security incident discovered on Feb 21, 2024, involving exfiltrated personal information of individuals in its patient support programs. Affected data included names, addresses, DOBs, health diagnoses, and medications. Cencora engaged law enforcement and cybersecurity experts, contained the incident, and offered 24 months of credit monitoring via Experian.

Lash Group, a partner of Cencora, Inc., notified consumers of a data security incident where data from Cencora's information systems was exfiltrated on February 21, 2024. Affected personal information included names, addresses, dates of birth, health diagnoses, and medications. Cencora engaged law enforcement and cybersecurity experts, contained the incident, and offered 24 months of credit monitoring. No evidence of fraud was found at the time of notification.

Cencora, Inc. notified California residents of a data breach discovered on February 21, 2024, where data was exfiltrated from its information systems. Affected data may include names, addresses, dates of birth, health diagnoses, and medications. Cencora engaged law enforcement and cybersecurity experts, contained the incident, and is offering 24 months of credit monitoring.

Cencora, Inc. (via Lash Group) notified California residents that data was exfiltrated from its information systems on February 21, 2024. The incident potentially affected personal information, including names, addresses, and Social Security numbers, of individuals involved in patient support programs. Cencora engaged law enforcement and cybersecurity experts, contained the incident, and is offering 24 months of credit monitoring.

Cencora, Inc. notified Vermont AG that on Feb 21, 2024, data from its systems was exfiltrated, potentially containing personal information. Cencora engaged law enforcement and cybersecurity experts. Affected data includes names, SSNs, and financial account numbers. Cencora offers 24 months of credit monitoring via Experian. No evidence of fraud found.

Cencora, Inc. notified California residents that data from its information systems was exfiltrated on February 21, 2024. The incident potentially affected personal information including name, address, date of birth, health diagnosis, and medications. Cencora engaged law enforcement and cybersecurity experts, contained the incident, and is offering 5 years of credit monitoring to affected individuals.

Cencora, Inc. notified Montana residents of a data security incident affecting personal and health information of individuals enrolled in Pfizer Inc.'s patient support programs via Lash Group. Cencora discovered unauthorized exfiltration on Feb 21, 2024. Data included names, addresses, DOB, and health diagnoses. Cencora engaged law enforcement and forensic experts, offering 24 months of credit monitoring.

Cencora, Inc. experienced a data breach on February 21, 2024, resulting in the exfiltration of personal information including names, addresses, dates of birth, health diagnoses, and medications. The Lash Group, a partner of Cencora, notified affected consumers in Vermont and other jurisdictions on June 7, 2024. No evidence of fraud was found. Cencora engaged forensic experts and law enforcement, and offered 24 months of credit monitoring via Experian.

Cencora, Inc., a third-party service provider for Pfizer Inc., notified consumers of a data security incident discovered on February 21, 2024. Personal information, including names, addresses, dates of birth, health diagnoses, and prescriptions, was exfiltrated. Cencora engaged law enforcement and cybersecurity experts, contained the incident, and provided 24 months of credit monitoring. No evidence of fraud was found at the time of notification.

On February 21, 2024, Cencora, Inc. learned that data from its information systems had been exfiltrated. The breach involved personal information held by its Lash Group affiliate in connection with patient support programs, including names, addresses, dates of birth, health diagnoses, and medications/prescriptions. Cencora engaged law enforcement, cybersecurity experts, and outside counsel. Affected individuals were offered 24 months of Experian IdentityWorks credit monitoring.

Cencora, Inc. notified consumers of a data breach discovered on February 21, 2024, where data from its information systems was exfiltrated. The incident affected personal information including names, addresses, dates of birth, health diagnoses, and medications/prescriptions. Cencora engaged law enforcement and cybersecurity experts, contained the incident, and offered 24 months of credit monitoring via Experian IdentityWorks. No evidence of fraud was found at the time of notification.

Cencora, Inc. notified consumers of a data breach discovered on February 21, 2024, where unauthorized actors exfiltrated personal information including names, addresses, dates of birth, health diagnoses, and medications. Cencora engaged law enforcement and cybersecurity experts, contained the incident, and provided 24 months of credit monitoring via Experian IdentityWorks.

Cencora, Inc. notified consumers of a data breach discovered on February 21, 2024, where unauthorized actors exfiltrated personal information including names, addresses, dates of birth, health diagnoses, and medications. Cencora engaged law enforcement and cybersecurity experts, contained the incident, and provided 24 months of credit monitoring via Experian. No evidence of fraud was found at the time of notification.

Cencora, Inc. and its Lash Group affiliate discovered on February 21, 2024 that data had been exfiltrated from its information systems. Affected data includes patient names, addresses, dates of birth, health diagnoses, and medications/prescriptions. Cencora engaged law enforcement, cybersecurity experts, and outside counsel, and is offering 24-month Experian IdentityWorks credit monitoring to affected individuals.

Cencora, Inc. notified Vermont consumers of a data security incident discovered on February 21, 2024, where data from its information systems was exfiltrated. The incident potentially affected personal information including names, addresses, dates of birth, health diagnoses, and medications. Cencora engaged cybersecurity experts and law enforcement, reinforced security protocols, and offered 24 months of credit monitoring via Experian IdentityWorks.

Cencora, Inc. notified California residents of a data breach discovered on February 21, 2024, involving the exfiltration of personal information from its information systems. Affected data may include names, addresses, dates of birth, health diagnoses, and medications. Cencora engaged law enforcement and cybersecurity experts, contained the incident, and is offering 24 months of credit monitoring to affected individuals.

Cencora, Inc. notified California residents that data from its information systems was exfiltrated on February 21, 2024. The incident potentially affected personal information including name, address, date of birth, health diagnosis, and medications. Cencora engaged law enforcement and cybersecurity experts, contained the incident, and is offering 24 months of credit monitoring to affected individuals.

Cencora, Inc. notified Montana residents of a data security incident where personal and health information was exfiltrated from its information systems. Cencora discovered the unauthorized access on February 21, 2024, and confirmed affected data on April 10, 2024. Affected data included names, addresses, DOB, and health diagnoses. Cencora engaged law enforcement and cybersecurity experts, and is offering 24 months of credit monitoring.

Cencora, Inc. notified consumers of a data security incident discovered on February 21, 2024, where data from its information systems was exfiltrated. The incident potentially affected personal information including names, addresses, dates of birth, health diagnoses, and medications. Cencora engaged law enforcement and cybersecurity experts, contained the incident, and offered 24 months of credit monitoring.

Cencora, Inc. notified California residents that data from its information systems was exfiltrated on February 21, 2024. The incident potentially affected personal information including name, address, date of birth, health diagnosis, and medications. Cencora engaged law enforcement and cybersecurity experts, contained the incident, and is offering 24 months of credit monitoring.

Cencora, Inc. notified the California Attorney General of a data breach involving its Lash Group affiliate. On February 21, 2024, Cencora learned that data from its information systems had been exfiltrated. The incident potentially affected personal information including names, addresses, dates of birth, health diagnoses, and medications. Cencora engaged law enforcement and cybersecurity experts, took containment steps, and is offering 24 months of credit monitoring to affected individuals.

Cencora, Inc. experienced a data breach on February 21, 2024, resulting in the exfiltration of personal information including names, addresses, dates of birth, health diagnoses, and medications. Lash Group, a partner, notified affected consumers on May 31, 2024. Cencora engaged law enforcement and cybersecurity experts, and offered 24 months of credit monitoring.

Cencora, Inc. notified California residents that data from its information systems was exfiltrated on February 21, 2024. The incident potentially affected personal information including name, address, date of birth, health diagnosis, and medications. Cencora engaged law enforcement and cybersecurity experts, contained the incident, and is offering 24 months of credit monitoring.

Cencora, Inc. (via Lash Group) notified Vermont consumers of a data security incident discovered on Feb 21, 2024, where data was exfiltrated from its information systems. Affected personal information included names, addresses, DOBs, health diagnoses, and medications. Cencora engaged law enforcement and cybersecurity experts, provided 5 years of credit monitoring, and reinforced security protocols. No evidence of fraud was found at the time of notice.