New SEC rules and Cencora breach result in surge of pharma data breach disclosures

The pharmaceutical industry is grappling with the consequences of a significant data breach at Cencora, the prominent drug distributor formerly known as AmerisourceBergen. Recent cybersecurity rules from the U.S. Securities and Exchange Commissions (SEC), which came into effect in December 2023, have also played a role in a wave of data breach reports, highlighting the extensive impact of the Cencora cyberattack, which occurred in February 2024.

Cencora originally disclosed the data breach in a SEC Form 8-K filing, divulging that unauthorized parties gained access to its information systems and exfiltrated personal data.

“Cencora previously disclosed that data from its information systems had been exfiltrated,” said Mike Iorfino, director, public relations at Cencora. “Upon initial detection of the unauthorized activity, we immediately took containment steps and commenced an investigation with the assistance of law enforcement, cybersecurity experts and external counsel.”

Iorfino also noted that Cencora’s investigation identified individuals whose personal information was involved in the incident. “While there is no evidence that any of the information has been publicly disclosed or misused for fraudulent purposes, we are issuing notification to impacted individuals and working to ensure they have access to resources to help them protect their information,” he said.

While some press outlets have speculated that the February 2024 cyberattack on the healthcare technology provider Change Healthcare and the May 2024 ransomware attack on the healthcare system Ascension, might be connected to the Cencora incident, Iorfino disputed the rumors. “I can confirm there is no connection,” he stated.

The Cencora breach affected some of the most prominent Big Pharma firms, including Novartis, Bayer, AbbVie, Regeneron, Genentech and Incyte. Also affected were Sumitomo Pharma America and Acadia Pharmaceuticals.

Cencora noted on its website that the following data was compromised:

Based on our investigation, personal information including personal health information was affected, including potentially first name, last name, date of birth, health diagnosis, and/or medications and prescriptions. There is no evidence that any of this information has been or will be publicly disclosed, or that any information was or will be misused for fraudulent purposes as a result of this incident, but we are communicating this so that affected individuals can take the steps outlined below to protect yourself.

---

Filed Under: clinical trials, Drug Discovery, Drug Discovery and Development, Regulatory affairs
Tagged With: AmerisourceBergen, Cencora, class action lawsuits, Cybersecurity, data breach, Patient data, SEC disclosure
 

---