Notice of Data Security Incident

TheraCom Pharmacy (“TheraCom”), a mail-order specialty pharmacy owned by Cencora, dispenses prescription medication at no charge to eligible patients enrolled in patient support programs. We take very seriously the protection of the information entrusted to us in providing these services. 

We are providing substitute notice of an event that involved certain individuals’ personal information and/or protected health information that we had regarding prescriptions filled at TheraCom or from our efforts to contact individuals about a prescription that their medical provider ordered.  

What Happened?
Earlier this year, Cencora learned that data from its information systems had been exfiltrated.  Upon initial detection of the unauthorized activity, we immediately took containment steps and commenced an investigation with the assistance of law enforcement, cybersecurity experts and outside lawyers.

What Information Was Involved?
Based on our investigation, some personal information was affected, including potentially first name, last name, address, date of birth, prescription information, medical treatment information, medical history, health insurance information, Medicare/Medicaid number, and/or medical record number.  There is no evidence that any of this information has been or will be publicly disclosed, or that any information was or will be misused for fraudulent purposes as a result of this incident, but we are communicating this so that affected individuals can take the steps outlined below to protect themselves.

What We Are Doing

Immediately upon learning of this incident, we launched an investigation with the assistance of cybersecurity experts, law enforcement, and outside lawyers.  Determining whether personal information or personal health information was compromised in any way has been one of the top priorities of this effort so that we could notify potentially affected individuals.  Please be assured that we are also working with cybersecurity experts to reinforce our systems and information security protocols in an effort to prevent incidents like this from occurring in the future.

We are also making resources available to those individuals whose information was involved.  While we have no reason to believe that any information was used for any fraudulent purpose as a result of this incident, to help protect affected individuals’ identities, we are providing access to Experian IdentityWorksSM credit monitoring and remediation services for 24 months at no charge to you.
  
To enroll in these services at no charge, visit https://www.experianidworks.com/plus and follow the instructions provided.  When prompted please provide the following unique code to receive services: ZXMBSB8GJV.  In order for you to receive the monitoring services described above, you must enroll by January 31, 2025.  Please note that when signing up for monitoring services, you may be asked to verify personal information for your own protection to confirm your identity.

Should you have any questions regarding the Credit Monitoring services, have difficulty enrolling, or require additional support, please contact Experian at 1-833-918-8818. Be prepared to provide engagement number B132687 as proof of eligibility for the Identity Restoration services by Experian.

What You Can Do

To help protect your personal information, we strongly recommend you take the following steps, all of which are good ideas in any event:

• Carefully review statements sent to you by your bank, credit card company, or other financial institutions as well as government institutions like the Internal Revenue Service (IRS).  Notify the sender of these statements immediately by phone and in writing if you detect any suspicious transactions or other activity you do not recognize.
• The Reference Guide below describes additional steps that you can take and provides resources for additional information.  We encourage you to read and follow these steps as well. 

For More InformationIf you have questions or concerns or learn of any suspicious activity that you believe may be related to this incident, please call 1-833-918-8818 from 9 am – 9 pm US Eastern Time. Please know that we take this matter very seriously, and we apologize for any concern and inconvenience this may cause you.  

REFERENCE GUIDE
If you suspect that you are a victim of identity theft or credit fraud, we encourage you to remain vigilant and consider taking the following steps:
 
Order Your Free Credit Report.  To order your free credit report, visit www.annualcreditreport.com, call toll-free at 877-322-8228, or complete the Annual Credit Report Request Form on the FTC’s website at www.ftc.gov and mail it to Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348-5281.  Do not contact the three credit bureaus individually; they provide your free report only through the website or toll-free number.  When you receive your credit report, review the entire report carefully.  Look for any inaccuracies and/or accounts you don’t recognize and notify the credit bureaus as soon as possible if there are any.
 
You have rights under the federal Fair Credit Reporting Act (“FCRA”).  These include, among others, the right to know what is in your file; to dispute incomplete or inaccurate information; and to have consumer credit reporting agencies correct or delete inaccurate, incomplete, or unverifiable information.  For more information about the FCRA, please visit https://www.consumerfinance.gov or www.ftc.gov. 
 
Place a Fraud Alert on Your Credit File:  A fraud alert helps protect you against the possibility of an identity thief opening new credit accounts in your name.  When a merchant checks the credit history of someone applying for credit, the merchant gets a notice that the applicant may be a victim of identity theft.  The alert notifies the merchant to take steps to verify the identity of the applicant.  You can report potential identity theft to all three of the major credit bureaus by calling any one of the toll-free fraud numbers below.  

Experian	Equifax	TransUnion
www.equifax.com	www.experian.com	www.transunion.com
1-800-525-6285	1-888-397-3742	1-800-680-7289
P.O. Box 740241 Atlanta, Georgia 30374-0241	P.O. Box 9532 Allen, Texas 75013	Fraud Victim Assistance Division P.O. Box 2000 Chester, Pennsylvania 19016

Place a Security Freeze on Your Credit File.  You have the right to place a “security freeze” on your credit file.  A security freeze generally will prevent creditors from accessing your credit file at the three nationwide credit bureaus without your consent.  You can request a security freeze free of charge by contacting the credit bureaus using the same contact information noted above.
 
The credit bureaus may require that you provide proper identification prior to honoring your request.  In order to request a security freeze, you will need to provide: (1) Your full name (including middle initial as well as Jr., Sr., II, III, etc.); (2) Social Security number; (3) Date of birth; (4) If you have moved in the past five (5) years, provide the addresses where you have lived over the prior five years; (5) Proof of current address, such as a current utility bill or telephone bill; (6) A legible photocopy of a government issued identification card (state driver’s license or ID card, military identification, etc.); and (7) If you are a victim of identity theft, include a copy of either the police report, investigative report, or complaint to law enforcement agency concerning identity theft.

Placing a security freeze on your credit file may delay, interfere with, or prevent timely approval of any requests you make for credit, loans, employment, housing or other services.  For more information regarding credit freezes, please contact the credit reporting agencies directly. 
 
Contact the U.S. Federal Trade Commission.  If you detect any incident of identity theft or fraud, promptly report the incident to your local law enforcement authorities, your state Attorney General and the Federal Trade Commission (“FTC”).  If you believe you identity has been stolen, the FTC recommends that you take these additional steps.
 
• Close the accounts that you have confirmed or believe have been tampered with or opened fraudulently.  Use the FTC’s ID Theft Affidavit (available at www.ftc.gov/idtheft) when you dispute new unauthorized accounts.
• File a local police report.  Obtain a copy of the police report and submit it to your creditors and any others that may require proof of the identity theft crime.
 
You can learn more about how to protect yourself from becoming an identity theft victim (including how to place a fraud alert or security freeze) by contacting the FTC:
 
Federal Trade Commission
Consumer Response Center
600 Pennsylvania Avenue, NW
Washington, DC 20580
1-877-IDTHEFT (438-4338); www.ftc.gov/idtheft
 
For District of Columbia Residents:  You can obtain information from the FTC and the Office of the Attorney General for the District of Columbia about steps to take to avoid identity theft.  You can contact the D.C. Attorney General at: 441 4th Street, NW, Washington, DC 200001, 202-727-3400, www.oag.dc.gov.

For Iowa Residents:  State law advises you to report any suspected identity theft to law enforcement or to the Attorney General.

For Maryland Residents:  You can obtain information from the Maryland Office of the Attorney General about steps you can take to help prevent identity theft.  You can contact the Maryland Attorney General at: 200 St. Paul Place, Baltimore, MD 21202, 888-743-0023, https://www.marylandattorneygeneral.gov. 

For Massachusetts Residents:  You have a right to request from us a copy of any police report filed in connection with this incident.  If you are the victim of identity theft, you also have the right to file a police report and obtain a copy of it.  As noted above, you also have the right to place a security freeze on your credit report at no charge.

For New York Residents:  You may also contact the following state agencies for information regarding security breach response and identity theft prevention and protection information:

 

New York Attorney General’s Office
Bureau of Internet and Technology
(212) 416-8433
https://ag.ny.gov 
NYS Department of State's Division of Consumer Protection
(800) 697-1220
https://www.dos.ny.gov/consumerprotection

For North Carolina Residents:  You can obtain information from the Federal Trade Commission and the North Carolina Office of the Attorney General about steps you can take to help prevent identity theft.  You can contact the North Carolina Attorney General at: 9001 Mail Service Center, Raleigh, NC 27699, 1-877-566-7226, www.ncdoj.gov.

For Oregon Residents:  State laws advise you to report any suspected identity theft to law enforcement, as well as the Federal Trade Commission.  You can contact the Oregon Attorney General at: Oregon Department of Justice, 1162 Court Street NE, Salem, OR 97301-4096, (877) 877-9392, www.doj.state.or.us.

For Rhode Island Residents:  You can obtain information from the Rhode Island Office of the Attorney General about steps you can take to help prevent identity theft.  You can contact the Rhode Island Attorney General at: 150 South Main Street, Providence, RI 02903, (401) 274-4400, www.riag.ri.gov.  As noted above, you have the right to place a security freeze on your credit report at no charge but note that consumer reporting agencies may charge fees for other service