Correspondence 0001140859-24-000101 from Cencora, Inc. (COR)
Cencora, Inc.
Date: June 20, 2024 · CIK: 0001140859 · Accession: 0001140859-24-000101
AI Filing Summary & Sentiment
File numbers found in text: 001-16671
Referenced dates: June 6, 2024
Letter
Document
Cencora, Inc.
1 West First Avenue
Conshohocken, PA 19428-1800
www.cencora.com
Phone 610.727.7000
June 20, 2024
United States Securities and Exchange Commission
Division of Corporation Finance
100 F. Street, N.E.
Washington, D.C. 20549
Attention: James Lopez and Rucha Pandit – Office of Finance
Re: Cencora, Inc.
Form 8-K filed February 27, 2024
File No. 001-16671
Ms. Pandit and Mr. Lopez:
This letter responds to the comment of the Staff (the "Staff") of the Securities and Exchange Commission (the "Commission") contained in your letter dated June 6, 2024 (the "Comment Letter") regarding the Current Report on Form 8-K that was filed by Cencora, Inc. (the "Company") with the Commission on February 27, 2024 (the "Form 8-K").
We have reproduced the comment contained in the Comment Letter (in italics) and have set forth the Company's response below the text of the comment.
Form 8-K
Item 1.05 Material Cybersecurity Incidents, page 1
1We note the statement you experienced a cybersecurity incident that, as of the date of the filing, did not have a material impact on your operations. Please advise us as to why you determined to file under Item 1.05 of Form 8-K given the statement that you have not yet determined whether the incident is reasonably likely to materially impact your financial condition or results of operations.
Response:
On July 26, 2023, the Commission adopted rules that require public companies to disclose material cybersecurity incidents under Item 1.05 of Form 8-K (the "Cybersecurity Rules"), with such disclosure rules going into effect as of December 18, 2023 (the "Effective Date"). As disclosed in the Form 8-K, which was filed approximately two months following the Effective Date, the Company learned on February 21, 2024 that data from its information systems had been exfiltrated (the "incident"). At the time the Company filed the Form 8-K, on February 27, 2024, the investigation into the incident and corresponding materiality analysis remained ongoing. Nonetheless, the Company believed that disclosing the incident to the public was appropriate in light of the policy underpinning the Cybersecurity Rules1 and prevailing market practice following the Effective Date.
Following the May 21, 2024 clarifying statement by Erik Gerding, Director of the Division of Corporation Finance, the Company understands that while companies should not be discouraged from voluntarily disclosing cybersecurity incidents for which they have not yet made a materiality determination, such disclosure should be made in another manner, such as under Item 8.01 of Form 8-K.2 The Company acknowledges this clarifying
__________________________________
1 The Commission noted in the Adopting Release for the Cybersecurity Rules that evidence suggests companies may be underreporting
cybersecurity incidents. See Adopting Release, p. 8, citing Bitdefender, Whitepaper: Bitdefender 2023 Cybersecurity Assessment (Apr. 2023), available at https://businessresources.bitdefender.com/bitdefender-2023-cybersecurity-assessment.
2 https://www.sec.gov/news/statement/gerding-cybersecurity-incidents-05212024#_ftn1
United States Securities and Exchange Commission
Division of Corporation Finance
June 20, 2024
statement and advises the Staff that it will consider all applicable guidance, together with the Adopting Release for the Cybersecurity Rules and Item 1.05 of Form 8-K, in determining whether and when to file future Current Reports on Form 8-K under Item 1.05.
Further, the Company respectfully advises the Staff that its investigation into the incident and corresponding materiality analysis remains ongoing and that it will file an amendment to the Form 8-K when it has determined whether the incident is reasonably likely to materially impact the Company’s financial condition or results of operations.
* * *
We understand that the Company and its management are responsible for the accuracy and adequacy of our disclosures, notwithstanding any review, comments, action or absence of action by the Staff.
Please contact the undersigned via email at korey.pirouz@cencora.com if you should have any questions regarding our responses.
Sincerely,
/s/ Kourosh Q. Pirouz
Show Raw Text
CORRESP
1
filename1.htm
Document
Cencora, Inc.
1 West First Avenue
Conshohocken, PA 19428-1800
www.cencora.com
Phone 610.727.7000
June 20, 2024
United States Securities and Exchange Commission
Division of Corporation Finance
100 F. Street, N.E.
Washington, D.C. 20549
Attention: James Lopez and Rucha Pandit – Office of Finance
Re: Cencora, Inc.
Form 8-K filed February 27, 2024
File No. 001-16671
Ms. Pandit and Mr. Lopez:
This letter responds to the comment of the Staff (the "Staff") of the Securities and Exchange Commission (the "Commission") contained in your letter dated June 6, 2024 (the "Comment Letter") regarding the Current Report on Form 8-K that was filed by Cencora, Inc. (the "Company") with the Commission on February 27, 2024 (the "Form 8-K").
We have reproduced the comment contained in the Comment Letter (in italics) and have set forth the Company's response below the text of the comment.
Form 8-K
Item 1.05 Material Cybersecurity Incidents, page 1
1We note the statement you experienced a cybersecurity incident that, as of the date of the filing, did not have a material impact on your operations. Please advise us as to why you determined to file under Item 1.05 of Form 8-K given the statement that you have not yet determined whether the incident is reasonably likely to materially impact your financial condition or results of operations.
Response:
On July 26, 2023, the Commission adopted rules that require public companies to disclose material cybersecurity incidents under Item 1.05 of Form 8-K (the "Cybersecurity Rules"), with such disclosure rules going into effect as of December 18, 2023 (the "Effective Date"). As disclosed in the Form 8-K, which was filed approximately two months following the Effective Date, the Company learned on February 21, 2024 that data from its information systems had been exfiltrated (the "incident"). At the time the Company filed the Form 8-K, on February 27, 2024, the investigation into the incident and corresponding materiality analysis remained ongoing. Nonetheless, the Company believed that disclosing the incident to the public was appropriate in light of the policy underpinning the Cybersecurity Rules1 and prevailing market practice following the Effective Date.
Following the May 21, 2024 clarifying statement by Erik Gerding, Director of the Division of Corporation Finance, the Company understands that while companies should not be discouraged from voluntarily disclosing cybersecurity incidents for which they have not yet made a materiality determination, such disclosure should be made in another manner, such as under Item 8.01 of Form 8-K.2 The Company acknowledges this clarifying
__________________________________
1 The Commission noted in the Adopting Release for the Cybersecurity Rules that evidence suggests companies may be underreporting
cybersecurity incidents. See Adopting Release, p. 8, citing Bitdefender, Whitepaper: Bitdefender 2023 Cybersecurity Assessment (Apr. 2023), available at https://businessresources.bitdefender.com/bitdefender-2023-cybersecurity-assessment.
2 https://www.sec.gov/news/statement/gerding-cybersecurity-incidents-05212024#_ftn1
United States Securities and Exchange Commission
Division of Corporation Finance
June 20, 2024
statement and advises the Staff that it will consider all applicable guidance, together with the Adopting Release for the Cybersecurity Rules and Item 1.05 of Form 8-K, in determining whether and when to file future Current Reports on Form 8-K under Item 1.05.
Further, the Company respectfully advises the Staff that its investigation into the incident and corresponding materiality analysis remains ongoing and that it will file an amendment to the Form 8-K when it has determined whether the incident is reasonably likely to materially impact the Company’s financial condition or results of operations.
* * *
We understand that the Company and its management are responsible for the accuracy and adequacy of our disclosures, notwithstanding any review, comments, action or absence of action by the Staff.
Please contact the undersigned via email at korey.pirouz@cencora.com if you should have any questions regarding our responses.
Sincerely,
/s/ Kourosh Q. Pirouz
Kourosh Q. Pirouz
Senior Vice President, Group General Counsel and Corporate Secretary
cc: Elizabeth S. Campbell, Cencora, Inc., Executive Vice President and Chief Legal Officer
Celia A. Soehner, Morgan, Lewis & Bockius, LLP