Notice of Data Security Incident

The Lash Group partners with pharmaceutical companies, pharmacies, and healthcare providers to facilitate access to therapies through drug distribution, patient support and services, business analytics and technology, and other services. We take very seriously the protection of the information entrusted to us in providing these services.

Lash Group is providing substitute notice of an event that involved certain individuals’ personal information and/or protected health information that Lash Group was in possession of through its current or past partnerships with organizations in connection with its patient support programs. It is important to note that we have no evidence at this time that any personal information and/or protected health information has been disclosed publicly or used for any fraudulent purpose as a result of this incident, but we are providing this notice to tell you what happened, what information was potentially involved, what we have done and what you can do to address this situation.

What Happened?

On February 21, 2024, Lash Group learned that data from its information systems had been exfiltrated, some of which could contain personal information. Upon initial detection of the unauthorized activity, we immediately took containment steps and commenced an investigation with the assistance of law enforcement, cybersecurity experts and outside lawyers. On May 8, 2024, Lash Group confirmed that individuals’ personal information may have been involved in the incident. For some individuals, Lash Group does not have address information to provide direct notice. Accordingly, Lash Group is posting this notice on its website.

What Information Was Involved?

Based on our investigation, the personal information the personal information may have involved first name, last name, address, date of birth, Social Security Number, and the fact that a diagnostic test may have been performed. Not all data elements were included for all individuals. There is no evidence that any results from that diagnostic test were involved. Further, there is no evidence that any of this information has been or will be publicly disclosed, or that any information was or will be misused for fraudulent purposes as a result of this incident.

What We Are Doing

Immediately upon learning of this incident, we launched an investigation with the assistance of cybersecurity experts, law enforcement, and outside lawyers. Determining whether personal information or protected health information was compromised in any way has been one of the top priorities of this effort so that we could notify potentially affected individuals. Please be assured that we are also working with cybersecurity experts to reinforce our systems and information security protocols in an effort to prevent incidents like this from occurring in the future.

We are also making resources available to those individuals whose information may have been involved. While we have no reason to believe that your information was used for any fraudulent purpose as a result of this incident we are providing you with access to Experian IdentityWorksSM credit monitoring and remediation services for 24 months at no charge to you.

To enroll in these services at no charge, visit https://www.experianidworks.com/plus and follow the instructions provided. When prompted please provide the following unique code to receive services: DKZ83MYGMV. In order for you to receive the monitoring services described above, you must enroll by September 30, 2024. Please note that when signing up for monitoring services, you may be asked to verify personal information for your own protection to confirm your identity.

Should you have any questions regarding the Credit Monitoring services, have difficulty enrolling, or require additional support, please contact Experian at 1-833-918-1728. Be prepared to provide engagement number B126097 as proof of eligibility for the Identity Restoration services by Experian.

What You Can Do

To help protect your personal information, we recommend you take the following steps, all of which are good ideas in any event:

  • Carefully review statements sent to you by your bank, credit card company, or other financial institutions as well as government institutions like the Internal Revenue Service (IRS). Notify the sender of these statements immediately by phone and in writing if you detect any suspicious transactions or other activity you do not recognize.
  • The Reference Guide below describes additional steps that you can take and provides resources for additional information. We encourage you to read and follow these steps as well.

For More Information

If you have questions or concerns or learn of any suspicious activity that you believe may be related to this incident, please call 1-833-918-1728 from 8:30 am – 5:30 pm US Eastern Time. Please know that we take this matter very seriously, and we apologize for any concern and inconvenience this may cause you.

REFERENCE GUIDE

Order Your Free Credit Report. To order your free credit report, visit www.annualcreditreport.com, call toll-free at 877-322-8228, or complete the Annual Credit Report Request Form on the U.S. Federal Trade Commission’s website at https://www.ftc.gov and mail it to Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348-5281. Do not contact the three credit bureaus individually; they provide your free report only through the website or toll-free number.

When you receive your credit report, review the entire report carefully. Look for any inaccuracies and/or accounts you don’t recognize and notify the credit bureaus as soon as possible if there are any.

You have rights under the federal Fair Credit Reporting Act (“FCRA”). These include, among others, the right to know what is in your file; to dispute incomplete or inaccurate information; and to have consumer credit reporting agencies correct or delete inaccurate, incomplete, or unverifiable information. For more information about the FCRA, please visit https://www.consumer.ftc.gov/articles/pdf-0096-fair-credit-reporting-act.pdf or www.ftc.gov

Place a Fraud Alert on Your Credit File: To protect yourself from possible identity theft, consider placing a fraud alert on your credit file. A fraud alert helps protect you against the possibility of an identity thief opening new credit accounts in your name. When a merchant checks the credit history of someone applying for credit, the merchant gets a notice that the applicant may be a victim of identity theft. The alert notifies the merchant to take steps to verify the identity of the applicant. You can report potential identity theft to all three of the major credit bureaus by calling any one of the toll-free fraud numbers below. You will reach an automated telephone system that allows you to flag your file with a fraud alert at all three bureaus.

Equifax Experian/td> TransUnion
www.equifax.com www.experian.com www.transunion.com
1-800-525-6285 1-888-397-3742 1-800-680-7289
P.O. Box 740241 Atlanta, Georgia 30374-0241 P.O. Box 9532 Allen, Texas 75013 Fraud Victim Assistance Division
P.O. Box 2000
Chester, Pennsylvania 19016


Place a Security Freeze on Your Credit File. You have the right to place a “security freeze” on your credit file. A security freeze generally will prevent creditors from accessing your credit file at the three nationwide credit bureaus without your consent. You can request a security freeze free of charge by contacting the credit bureaus using the same contact information noted above.

The credit bureaus may require that you provide proper identification prior to honoring your request. In order to request a security freeze, you will need to provide the following information:

  1. Your full name (including middle initial as well as Jr., Sr., II, III, etc.)
  2. Social Security number
  3. Date of birth
  4. If you have moved in the past five (5) years, provide the addresses where you have lived over the prior five years.
  5. Proof of current address, such as a current utility bill or telephone bill
  6. A legible photocopy of a government issued identification card (state driver’s license or ID card, military identification, etc.)
  7. If you are a victim of identity theft, include a copy of either the police report, investigative report, or complaint to law enforcement agency concerning identity theft.

Placing a security freeze on your credit file may delay, interfere with, or prevent timely approval of any requests you make for credit, loans, employment, housing or other services. For more information regarding credit freezes, please contact the credit reporting agencies directly.

Contact the U.S. Federal Trade Commission. If you detect any incident of identity theft or fraud, promptly report the incident to your local law enforcement authorities, your state Attorney General and the Federal Trade Commission (“FTC”). If you believe you identity has been stolen, the FTC recommends that you take these additional steps.

  • Close the accounts that you have confirmed or believe have been tampered with or opened fraudulently. Use the FTC’s ID Theft Affidavit (available at https://www.ftc.gov/idtheft) when you dispute new unauthorized accounts.
  • File a local police report. Obtain a copy of the police report and submit it to your creditors and any others that may require proof of the identity theft crime.

You can learn more about how to protect yourself from becoming an identity theft victim (including how to place a fraud alert or security freeze) by contacting the FTC:

Federal Trade Commission
Consumer Response Center
600 Pennsylvania Avenue, NW
Washington, DC 20580
1-877-IDTHEFT (438-4338)
https://www.ftc.gov/idtheft

 

For District of Columbia Residents: You can obtain information from the FTC and the Office of the Attorney General for the District of Columbia about steps to take to avoid identity theft. You can contact the D.C. Attorney General at: 441 4th Street, NW, Washington, DC 200001, 202-727-3400, www.oag.dc.gov

For Maryland Residents: You can obtain information from the Maryland Office of the Attorney General about steps you can take to help prevent identity theft. You can contact the Maryland Attorney General at: 200 St. Paul Place, Baltimore, MD 21202, 888-743-0023, www.oag.state.md.us

For Massachusetts Residents: You have a right to request from us a copy of any police report filed in connection with this incident. If you are the victim of identity theft, you also have the right to file a police report and obtain a copy of it. As noted above, you also have the right to place a security freeze on your credit report at no charge.

For New York Residents: You may also contact the following state agencies for information regarding security breach response and identity theft prevention and protection information:

New York Attorney General’s Office
Bureau of Internet and Technology
(212) 416-8433
https://ag.ny.gov/internet/resource-center
NYS Department of State's Division of Consumer Protection
(800) 697-1220

https://www.dos.ny.gov/consumerprotection

 

For North Carolina Residents: You can obtain information from the Federal Trade Commission and the North Carolina Office of the Attorney General about steps you can take to help prevent identity theft. You can contact the North Carolina Attorney General at: 9001 Mail Service Center, Raleigh, NC 27699, 1-877-566-7226, www.ncdoj.gov