F500 Pharma & Biotech · Pharmaceuticals · No confirmed finding (unverified, not clean)
Merck
Headline
Nothing confirmed
Nothing company-specific confirmed this pass on consumer data privacy.
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
What this pass recorded. Nothing company-specific confirmed this pass on consumer data privacy. Merck's most significant cyber event was NotPetya in 2017 - a destructive attack rather than a data-theft one, notable mainly for the multi-year insurance litigation over whether an act-of-war exclusion applied, which drew wide attention in the cyber-insurance market (litigation details not re-verified this pass). That is a corporate-risk finding rather than a consumer-privacy one and is recorded as such. Recommend checking Merck against the Cencora patient-support notification list.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected.
Data sharing
Not independently confirmed this pass with a company-specific consumer data lawsuit beyond the shared industry findings below. SHARED FINDING ACROSS MANY PHARMA COMPANIES: (1) A 2024 breach at CENCORA (a major pharmaceutical distributor, documented separately in the Healthcare Providers tab of this tracker) exposed patient information — names, addresses, birthdates, health diagnoses, and prescriptions — reportedly for patients of more than a dozen manufacturers' programs (Bayer, Genentech, AbbVie, Novartis, Regeneron, GSK and others were reported); whether Merck was among them was NOT verified this pass. (2) A SEPARATE 2026 lawsuit (reported; not independently verified, current status unknown as of Oct 2026) (Illinois, under the state's Genetic Information Privacy Act) alleges Tempus AI transferred patients' genetic testing data to pharmaceutical and biotech partners without adequate consent; whether the suit names Merck as a recipient was NOT verified this pass (allegations only), and a reported Tempus CFO 'record year' remark was not verified.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy See Merck's own published privacy policy | Not fetched yet | NOT CONFIRMED |
| Terms of service See Merck's own published terms of service | Not fetched yet | NOT CONFIRMED |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.