Photo credit: Tima Miroshnichenko/Pexels
Pharmaceutical company Cencora faced a cyberattack, which allowed the hacker group Dark Angels to run away with $75 million — the largest known cyberextortion attack. 

It was noticed that the payment for the Cencora hack was conducted in three different transactions of Bitcoin back in March. The initial ransom demand was $150 million as the hacker group had stolen the data from its system. 

Initially, cybersecurity firms Zscaler and Chainalysis noticed that the Dark Angels received a $75 million ransom. However, the firms were unable to identify from whom the hacker group obtained the money.

Later, Bloomberg reported, citing a person familiar with the unreported attack, that Cencora's data had been breached and a ransom was paid.

It was reported that Cencora notified individuals and state authorities about the data breach two months after the incident was disclosed. 

Additionally, a closer look at the financial statements showed the company reported $31.4 million under “other” expenses, claiming it was used for a cybersecurity event, although the actual details of the expense are yet to be disclosed.

Zscaler’s ThreatLabz 2024 Ransomware Report indicated that the uncovered $75 million ransom payment contributed to an 18% year-over-year increase in cyberattacks. Additionally, the Cencora hack by Dark Angels made it rank first in the five hacker groups to watch in 2024-2025.

Despite the increase in losses from cyberattacks, Chainalysis reported a decline in illicit transactions. Meanwhile, the median ransom payment to the most active ransomware strains spiked from just $200,000 in early 2023 to $1.5 million by mid-June 2024.
Although losses continue to rise, regulators and security firms are still investigating the activities of these hacker groups.