Back to all incidents

Cencora

cencora.com
CONFIRMED

Official SEC Form 8-K Item 1.05 disclosure filed by Cencora regarding a material cybersecurity incident.

Observable Status CONFIRMED
Industry / Sector Technology & Commercial
Incident Classification Material Cybersecurity Incident
Attributed Threat Actor Unattributed / Unknown
Affected Population Scope Under Audit
First Seen 2024-02-27
Last Updated 2024-02-27
OPEN WEIGHTS TELEMETRY • DETERMINISTIC CONFIDENCE

Confidence & Source Corroboration

80% CONFIDENCE
1. Primary Authority CONFIRMED BY REGULATOR Base weight: 65%
2. Evidence Specificity +15% Statutory Filing Verified
3. Corroboration Curve +0% 1 independent domain
4. Timeline & Staleness +0% 2 milestones logged
Corroborated Source Domains:
sec.gov
STATUTORY REGULATORY DISCLOSURES

Official Regulatory Filings & Legal Compliance Records

2 Verified Statutory Filings
Regulatory Ground Truth Standard: The disclosures below represent formal statutory filings and enforcement records submitted to government regulatory authorities (SEC, State Attorneys General, HHS OCR, FTC, FCC, EU/UK DPAs). In accordance with repository principles, this data is captured exactly as filed by the reporting entity and is never modified, overridden, or synthesized by AI models.
SEC

Form 8-K Item 1.05

CONFIRMED BY REGULATOR
Docket / Accession ID 0001104659-24-028288
Statutory Filing Date 2024-02-27
Disclosed Impact Scope Under Audit
Evidence Standard Regulatory Ground Truth
Statutory Filing Details & Summary (Preserved As Filed):

Item 1.05Material Cybersecurity Incidents.

On February 21, 2024, Cencora, Inc. (the "Company"),
learned that data from its information systems had been exfiltrated, some of which may contain personal information. Upon initial detection
of the unauthorized activity, the Company immediately took containment steps and commenced an investigation with the assistance of law
enforcement, cybersecurity experts and external counsel.

As of the date of this filing, the incident has not had a material
impact on the Company's operations, and its information systems continue to be operational. The Company has not yet determined whether
the incident is reasonably likely to materially impact the Company's financial condition or results of operations.

Forward-Looking Statements

Certain of the statements contained in this Current Report on Form 8-K
are "forward-looking statements" within the meaning of Section 27A of the Securities Act of 1933, as amended, and Section 21E
of the Securities Exchange Act of 1934, as amended (the "Securities Exchange Act"). Words such as "aim," "anticipate,"
"believe," "can," "continue," "could,", "estimate," "expect,"
"intend," "may," "might," "on track," "opportunity," "plan," "possible,"
"potential," "predict," "project," "seek," "should," "strive,"
"sustain," "synergy," "target," "will," "would" and similar expressions are
intended to identify forward-looking statements, but the absence of these words does not mean that a statement is not forward-looking.
These statements are based on management's current expectations and are subject to uncertainty and changes in circumstances and
speak only as of the date hereof. These statements are not guarantees of future performance and are based on assumptions and estimates
that could prove incorrect or could cause actual results to vary materially from those indicated. A more detailed discussion of the risks
and uncertainties that could cause our actual results to differ materially from those indicated is included in the "Risk Factors"
and "Management's Discussion and Analysis" sections in the Company's Annual Report on Form 10-K for the fiscal
year ended September 30, 2023 and elsewhere in that report and (ii) other reports filed by the Company pursuant to the Securities
Exchange Act. The Company undertakes no obligation to publicly update or revise any forward-looking statements, except as required by
the federal securities laws.

View Official Regulatory Filing Document https://www.sec.gov/Archives/edgar/data/1140859/000110465924028288/0001104659-24-028288-index.htm
SEC

Form 8-K Item 1.05

CONFIRMED BY REGULATOR
Docket / Accession ID 0001104659-24-084351
Statutory Filing Date 2024-07-31
Disclosed Impact Scope Under Audit
Evidence Standard Regulatory Ground Truth
Statutory Filing Details & Summary (Preserved As Filed):

Item 1.05Material Cybersecurity Incidents.

In the Original Report the Company disclosed that
it learned, on February 21, 2024, that data from its information systems had been exfiltrated, some of which may contain personal
information. Upon initial detection of the unauthorized activity, the Company immediately took containment steps and commenced an investigation
with the assistance of law enforcement, cybersecurity experts and external counsel.

Through that investigation, the Company learned
that additional data, beyond what was initially identified, had been exfiltrated. The Company has identified and completed its review
of most of the exfiltrated data (the "Data"). This review has confirmed that the Data included personally identifiable information
("PII") and protected health information ("PHI") of individuals, most of which is maintained by a Company subsidiary
that provides patient support services.

For PII and PHI discovered in the Data to date,
the Company has provided required notifications to potentially affected parties and individuals as well as regulatory agencies. The Company
continues to review the Data and it intends to provide any additional required notifications to affected and potentially affected parties
and appropriate regulatory agencies. The Company has no evidence that any of the Data has been or will be publicly disclosed.

The Company believes it has contained the incident,
and the Company has undertaken remediation efforts, which are ongoing. As part of its remediation efforts, the Company is working with
cybersecurity experts to reinforce its systems, strengthen its surveillance of cybersecurity threats and prevent unauthorized occurrences
on or conducted through its IT systems.

The incident has not had a material impact on
the Company's operations, and its information systems have continued to be fully operational. The Company does not believe the incident
is reasonably likely to materially impact the Company's financial condition or results of operations.

Forward-Looking Statements

Certain of the statements contained in this Current
Report on Form 8-K are "forward-looking statements" within the meaning of Section 27A of the Securities Act of 1933,
as amended, and Section 21E of the Securities Exchange Act of 1934, as amended (the "Securities Exchange Act"). Words
such as "aim," "anticipate," "believe," "can," "continue," "could,",
"estimate," "expect," "intend," "may," "might," "on track," "opportunity,"
"plan," "possible," "potential," "predict," "project," "seek,"
"should," "strive," "sustain," "synergy," "target," "will," "would"
and similar expressions are intended to identify forward-looking statements, but the absence of these words does not mean that a statement
is not forward-looking. These statements are based on management's current expectations and are subject to uncertainty and changes
in circumstances and speak only as of the date hereof. These statements are not guarantees of future performance and are based on assumptions
and estimates that could prove incorrect or could cause actual results to vary materially from those indicated. A more detailed discussion
of the risks and uncertainties that could cause our actual results to differ materially from those indicated is included in (i) the
"Risk Factors" and "Management's Discussion and Analysis" sections in the Company's Annual Report
on Form 10-K for the fiscal year ended September 30, 2023 and elsewhere in that report and (ii) other reports filed by
the Company pursuant to the Securities Exchange Act. The Company undertakes no obligation to publicly update or revise any forward-looking
statements, except as required by the federal securities laws.

View Official Regulatory Filing Document https://www.sec.gov/Archives/edgar/data/1140859/000110465924084351/0001104659-24-084351-index.htm

Technical Forensic Briefing

Incident Overview

Cencora, within its operating sector, has been subject to a cybersecurity incident disclosed to federal securities regulators. Ground-truth telemetry indicates the event prompted statutory disclosure under SEC cybersecurity reporting mandates.

Official SEC Form 8-K Item 1.05 disclosure filed by Cencora regarding a material cybersecurity incident.

Compromised Assets & Data Scope

The specific volume of affected customer, employee, or organizational records remains under active technical audit or disclosed in primary filings. Primary online perimeter and corporate domains include cencora.com.

Specific classes of compromised records, infrastructure, or operational systems are detailed in the official statutory filings below.

Statutory Disclosures & Compliance

  • SEC Filing: Form 8-K Item 1.05 (0001104659-24-028288) - Filing Link

Milestone Timeline (2 events logged)

2024-02-27 16:00 UTC
CONFIRMED BY REGULATOR

SEC Form 8-K Item 1.05 Disclosure

2024-07-31 16:00 UTC
CONFIRMED BY REGULATOR

SEC Form 8-K Item 1.05 Disclosure

Have updated information or a new verifiable source?

This incident record is a flat Markdown file tracked in Git. Propose an update or add a milestone via Pull Request.

Propose Update via GitHub