On May 20, 2024, Lash Group filed a notice of data breach with the various state Attorney General offices after discovering that personal information provided to the company by one of its clients, Bayer Corporation, was subject to unauthorized access. In this notice, Lash Group explains that the incident resulted in an unauthorized party being able to access consumers’ sensitive information, which includes their first names, last names, addresses, dates of birth, health diagnoses, and medications or prescriptions. Upon completing its investigation, Lash Group began sending out data breach notification letters to all individuals whose information was affected by the recent data security incident.

If you received a data breach notification from Lash Group about information you provided to Bayer Corp., it is essential you understand what is at risk and what you can do about it. A data breach lawyer can help you learn more about how to protect yourself from becoming a victim of fraud or identity theft, as well as discuss your legal options following the Lash Group / Bayer data breach. For more information, please see our recent piece on the topic here.

What Caused the Data Breach Affecting Bayer Patients?

The Lash Group / Bayer data breach was only recently announced, and more information is expected in the near future. However, Lash Group’s filings with various state attorney general offices provide some important information on what led up to the breach. According to these sources, on April 10, 2024, Lash Group completed an investigation into an earlier data security incident in which an unauthorized party was able to access confidential information belonging to individuals who provided their information to Bayer Corporation. Lash Group obtained this information as a result of a partnership with Bayer.

Upon learning that sensitive consumer data was accessible by an unauthorized party, Lash Group reviewed the compromised files to determine what information was leaked and which consumers were impacted. Lash Group notified Bayer about the incident on April 18, 2024. While the breached information varies depending on the individual, it may include your first name, last name, address, date of birth, health diagnosis, and medications or prescriptions.

On May 20, 2024, Lash Group sent out data breach letters to anyone who was affected by the recent data security incident. These letters should provide victims with a list of what information belonging to them was compromised.

More Information About Lash Group and Bayer Corp.

Founded in 1986, Lash Group is a division of the AmerisourceBergen Corporation, which is now Cencora. Based in Fort Mill, South Carolina, Lash Group provides patient access services to pharmaceutical companies, including programs designed to ensure those patients are able to obtain the medication they need, regardless of their ability to pay. Lash Group employs more than 4,000 people and generates approximately $845 million in annual revenue.

Bayer Corporation is a German pharmaceutical and biotechnology headquartered in Leverkusen. Bayer's areas of business include pharmaceuticals, consumer healthcare products, agricultural chemicals, seeds, and biotechnology products. Bayer employs roughly 100,000 people and generates over $52 billion in revenue each year.