American pharmaceutical sourcing and distributions company Cencora said it suffered a data scrutiny incident that compromised the sensitive personal information of Bristol Myers Squibb customers.
In a data breach notice filed with the state authorities of Massachusetts, Cencora, formerly known as AmerisourceBergen, said that on February 21, it became aware of a data security incident where threat actors infiltrated its internal network and stole sensitive personal data stored in the company database.
Cencora immediately launched an internal investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident. The investigation, which was concluded on April 10, revealed that the sensitive personal information of New Jersey-based pharmaceutical company Bristol Myers Squibb’s customers were compromised during the incident.
The compromised data included customers’ full names, addresses, dates of birth, health diagnosis information, and medications and prescriptions data.
While Cencora found no evidence of the compromised information being misused, it has advised all affected individuals to regularly monitor their credit reports, bank accounts and benefit statements and report any suspicious activity to law enforcement authorities, including the police and the state attorney general.
It has also offered two years of complimentary identity protection and credit monitoring services through Experian IdentityWorks to all affected individuals.
The data breach was first identified by cyber security researcher Dominic Alvieri in February. He said in a tweet that the Lorenz ransomware gang resurfaced by targeting the pharmaceutical company after laying low for a while. “AmerisourceBergen subsidiary is being accessed through a Lorenz back door,” he tweeted.
The files posted by the Lorenz gang belonged to AmerisourceBergen and MWI Animal Health, a subsidiary whose internal network was infiltrated by the threat actor. While the files were published recently, the threat actor’s post dates back to November 1, 2022, indicating that the security incident took place a few months ago.
