01—Abstract
Summary
Summary of the 8-K/A filed July 31, 2024. Cited figures are marked; the original filing is the authoritative source.
Cencora, Inc. (COR) filed an 8-K/A amendment on July 31, 2024, providing an update on a material cybersecurity incident first disclosed in February 2024.
The investigation confirmed that additional data, including Personally Identifiable Information (PII) and Protected Health Information (PHI) from a subsidiary providing patient support services, was exfiltrated beyond initial estimates. The company has completed its review of most exfiltrated data, has issued required notifications to affected parties and regulatory agencies, and continues to review remaining data for further notification needs. Cencora has no evidence that the exfiltrated data has been or will be publicly disclosed.
The company states that it believes the incident has been contained and is undertaking ongoing remediation efforts, including reinforcing systems and enhancing cybersecurity surveillance. Importantly, Cencora asserts that the incident has not had a material impact on its operations and does not believe it is reasonably likely to materially impact its financial condition or results of operations. Investors should monitor any further updates regarding notifications and the ongoing remediation process.
02—Key points
Key Highlights
- Cencora disclosed an update on a material cybersecurity incident initially identified in February 2024 via an 8-K/A filing on July 31, 2024.
- Investigation confirmed exfiltration of additional data beyond initial findings, including PII and PHI from a patient support services subsidiary.
- Company has completed review of most exfiltrated data and has issued required notifications to affected parties and regulatory agencies.
- Cencora has no evidence of public disclosure or intent to publicly disclose the exfiltrated data.
- The company believes the incident is contained and is actively engaged in ongoing remediation efforts to strengthen its systems.
- Cencora states the incident has not materially impacted operations and is not reasonably likely to materially impact financial condition or results of operations.
03—Questions
Frequently Asked Questions
What is the nature of the cybersecurity incident Cencora is reporting?
Cencora reported a material cybersecurity incident where data, including Personally Identifiable Information (PII) and Protected Health Information (PHI) from a subsidiary providing patient support services, was exfiltrated from its information systems. This is an update to a previously disclosed incident.
Has Cencora notified affected individuals and regulators?
Yes, Cencora has completed its review of most of the exfiltrated data and has provided required notifications to potentially affected parties and individuals, as well as to regulatory agencies. They continue to review remaining data and will issue additional notifications if required.
What is the company's assessment of the impact of this incident?
Cencora believes the incident has been contained and is undertaking remediation efforts. The company states that the incident has not had a material impact on its operations and does not believe it is reasonably likely to materially impact its financial condition or results of operations.
Is there any indication the compromised data has been or will be made public?
Cencora explicitly states that they have no evidence that any of the exfiltrated data has been or will be publicly disclosed.
04—Continue