Cencora, a healthcare solutions provider, paid a total of $75 million to a ransomware group following a data breach in February 2024.
Details of the Attacks
The publicly traded drug distributor, formerly known as AmerisourceBergen, sent Bitcoin worth $75 million to cyber attackers after a data breach. According to a Bloomberg report on September 18, Cencora sent the hackers BTC in three transactions. The attackers had initially demanded $150 million.
Blockchain Investigation
While the Bloomberg article did not share details of the three transactions, blockchain sleuth ZachXBT did. In a post on X, he revealed that Cencora sent 296.5 BTC on March 7, 2024, at 10:04 p.m. UTC. The next two transfers occurred on March 8, 2024—the first of 408 BTC at 7:45 p.m. UTC and the next totaling 387 BTC at 9:39 p.m. UTC. The hackers were identified as the Dark Angels ransomware group.
History of Ransomware Attacks
According to the Bloomberg article, the $75 million ransom is the highest in such payments' history. This surpasses previous incidents where payouts exceeded $40 million, the last of which occurred in 2021. Earlier this year, the FBI reported that ransomware attacks defrauded over 250 companies across the U.S., Europe, and Australia. While ransomware attacks using crypto schemes continue to be a concern, a Chainalysis report in May 2024 showed that payments to such attackers declined by nearly 50% in 2023.
Ransomware attacks continue to pose a significant threat despite a decrease in payments. The Cencora incident underscores the need for enhanced cybersecurity measures.
Comments