Cencora

Cencora reportedly paid $75 million in Bitcoin to the Dark Angels ransomware group in three March 2024 transactions (per Bloomberg, citing unnamed sources; Cencora has not confirmed the payment) - the largest known cyber extortion payment ever made, against an initial demand of $150 million. The stolen data included names, addresses, dates of birth, DIAGNOSES, prescriptions and medications, and Cencora held it through partnerships with drug makers running patient support programmes: patients of at least 27 pharmaceutical and biotech companies were caught in the same incident (HIPAA Journal, compiling state AG breach notices; the later class settlement lists 42 Cencora/Lash Group customers whose information was involved). That is the finding a patient could not have anticipated - enrolling in a manufacturer's copay assistance programme routed diagnosis-level data to a wholesale distributor most people have never heard of. No ransomware group ever publicly claimed the attack, which is consistent with a payment having been made. Cencora is also a defendant in the $21 billion opioid distributor settlement.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-08-04

Case status. Private litigation; the legal tier of its sources has not been assigned yet.

Primary source. nationalopioidsettlement.com/executive-summary/ — Verified - primary source confirmed.

Arbitration

Not independently confirmed this pass — standard binding arbitration + class action waiver expected.

Contacts

Privacy contact. Not recorded.

Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.

Mailing address. Not recorded.