The Largest Ransom on Record, and a Filing That Mentions No Ransom

On 21 February 2024 the pharmaceutical distributor Cencora, formerly AmerisourceBergen, learned that data had been taken from its systems. It filed a Form 8-K under Item 1.05 six days later. This desk has retrieved that filing from EDGAR and read it.

The filing goes on to say that the incident "has not had a material impact on the Company’s operations, and its information systems continue to be operational", and that the company had "not yet determined whether the incident is reasonably likely to materially impact" its financial condition or results.

That is the whole of the disclosure. It runs to two paragraphs, and there is nothing wrong with it.

On 29 July 2024 Zscaler’s ThreatLabz reported that a Fortune 50 company had paid $75m to the Dark Angels ransomware operation. Chainalysis subsequently confirmed the figure as the largest ransom payment it had ever recorded, against a previous high of $40m paid by CNA Financial in 2021.

Zscaler did not name the victim and has continued not to. Reporters reasoned towards Cencora from the timing, the sector and the 8-K. Bloomberg Law then reported, citing people it did not name, that Cencora had paid — $150m demanded, $75m settled, three bitcoin transfers in March.

Asked about it, a Cencora representative declined to comment and said the company does not respond to rumour or speculation. As far as this desk can establish, that remains the company’s position.

The desk grades this file medium for one reason: the largest and most quoted number in it is the one whose owner is least established. A $75m payment to Dark Angels happened. That Cencora made it is a reported attribution resting on unnamed sources and on an inference from timing.

It is tempting to read the 8-K as evasive — a company saying nothing much happened while, on the reported account, wiring the largest extortion payment in history. That reading is wrong, and the reason it is wrong matters more than the incident.

Item 1.05 asks a registrant to describe the material aspects of a cybersecurity incident’s nature, scope and timing, and its material impact on the registrant. It does not ask whether a ransom was demanded. It does not ask whether one was paid, or how much, or to whom.

So a company can file a complete and accurate disclosure that satisfies the rule and never mention a payment of any size, because the payment is not among the things the rule asks about. Nothing was withheld. Nothing was required.

The corpus records ransom amounts sparingly and always with a provenance label, because they almost never come from the payer. They come from chain analysis, from vendor reports, from leak-site boasts, and occasionally from unnamed sources speaking to a reporter.

This file shows why that will not change. The one party that knows the number is under no obligation to state it, and has a straightforward interest in not doing so. Every published total of ransomware payments is therefore built from traces of the transaction rather than from any record of it — which is a reasonable way to count, and not the same thing as counting.

Set against 24-0711, where a $25m payment was chain-traced and attributed to CDK Global without company confirmation, and 24-0301, where Change Healthcare did confirm paying: the confirmation is the exception in this corpus, not the rule.

Cencora ultimately notified more than 1.43 million individuals, and reporting identified data belonging to patients of more than two dozen pharmaceutical and biotechnology companies that used its services. Names, addresses, dates of birth, diagnoses and prescribed medications were among the categories described.

Cencora and The Lash Group later agreed to pay $40m to settle the consolidated class litigation. That figure is in court filings and is not in dispute.

It is worth holding those two amounts next to each other. If the reported ransom is right, the payment made to keep the data quiet was nearly twice the payment later made to the people whose data it was — and only one of the two was ever compelled.