Cybersecurity incident disclosed by Cencora, Inc. in a Form 8-K (February 2024)

Material Cybersecurity Incidents. On February 21, 2024, Cencora, Inc. (the “Company”), learned that data from its information systems had been exfiltrated, some of which may contain personal information. Upon initial detection of the unauthorized activity, the Company immediately took containment steps and commenced an investigation with the assistance of law enforcement, cybersecurity experts and external counsel. As of the date of this filing, the incident has not had a material impact on the Company’s operations, and its information systems continue to be operational. The Company has not yet determined whether the incident is reasonably likely to materially impact the Company’s financial condition or results of operations. Forward-Looking Statements Certain of the statements contained in this Current Report on Form 8-K are “forward-looking statements” within the meaning of Section 27A of the Securities Act of 1933, as amended, and Section 21E of the Securities Exchange Act of 1934, as amended (the “Securities Exchange Act”). Words such as “aim,” “anticipate,” “believe,” “can,” “continue,” “could,”, “estimate,” “expect,” “intend,” “may,” “might,” “on track,” “opportunity,” “plan,” “possible,” “potential,” “predict,” “project,” “seek,” “should,” “strive,” “sustain,” “synergy,” “target,” “will,” “would” and similar expressions are intended to identify forward-looking statements, but the absence of these words does not mean that a statement is not forward-looking. These statements are based on management’s current expectations and are subject to uncertainty and changes in circumstances and speak only as of the date hereof. These statements are not guarantees of future performance and are based on assumptions and estimates that could prove incorrect or could cause actual results to vary materially from those indicated. A more detailed discussion of the risks and uncertainties that could cause our actual results to differ materially from those indicated is included…

Material Cybersecurity Incidents. In the Original Report the Company disclosed that it learned, on February 21, 2024, that data from its information systems had been exfiltrated, some of which may contain personal information. Upon initial detection of the unauthorized activity, the Company immediately took containment steps and commenced an investigation with the assistance of law enforcement, cybersecurity experts and external counsel. Through that investigation, the Company learned that additional data, beyond what was initially identified, had been exfiltrated. The Company has identified and completed its review of most of the exfiltrated data (the “Data”). This review has confirmed that the Data included personally identifiable information (“PII”) and protected health information (“PHI”) of individuals, most of which is maintained by a Company subsidiary that provides patient support services. For PII and PHI discovered in the Data to date, the Company has provided required notifications to potentially affected parties and individuals as well as regulatory agencies. The Company continues to review the Data and it intends to provide any additional required notifications to affected and potentially affected parties and appropriate regulatory agencies. The Company has no evidence that any of the Data has been or will be publicly disclosed. The Company believes it has contained the incident, and the Company has undertaken remediation efforts, which are ongoing. As part of its remediation efforts, the Company is working with cybersecurity experts to reinforce its systems, strengthen its surveillance of cybersecurity threats and prevent unauthorized occurrences on or conducted through its IT systems. The incident has not had a material impact on the Company’s operations, and its information systems have continued to be fully operational. The Company does not believe the incident is reasonably likely to materially impact the Company’s financial condition or results…