The Lash Group partners with pharmaceutical companies, pharmacies, and healthcare providers to facilitate access to therapies through drug distribution, patient support and services, business analytics and technology, and other services. We take very seriously the protection of the information entrusted to us in providing these services.

Lash Group is providing substitute notice of an event that involved certain individuals’ personal information and/or protected health information that Lash Group has through its partnership with organizations in connection with its patient support programs. It is important to note that we have no evidence at this time that any personal information and/or protected health information has been disclosed publicly or used for any fraudulent purpose as a result of this incident, but we are providing this notice to tell you what happened, what information was potentially involved, what we have done and what you can do to address this situation.

What Happened?
Lash Group’s parent company previously disclosed that data from its information systems had been exfiltrated, some of which could contain personal information. Upon initial detection of the unauthorized activity, we immediately took containment steps and commenced an investigation with the assistance of law enforcement, cybersecurity experts and outside lawyers. Lash Group has now confirmed that individuals’ personal information was affected by the incident. For some individuals, Lash Group does not have address information to provide direct notice. Accordingly, Lash Group is posting this notice on its website.

What Information Was Involved?
Based on our investigation, personal information including personal health information was affected, including potentially first name, last name, date of birth, health diagnosis, and/or medications and prescriptions. There is no evidence that any of this information has been or will be publicly disclosed, or that any information was or will be misused for fraudulent purposes as a result of this incident, but we are communicating this so that affected individuals can take the steps outlined below to protect yourself.

What We Are Doing
Immediately upon learning of this incident, we launched an investigation with the assistance of cybersecurity experts, law enforcement, and outside lawyers. Determining whether personal information or personal health information was compromised in any way has been one of the top priorities of this effort so that we could notify potentially affected individuals. Please be assured that we are also working with cybersecurity experts to reinforce our systems and information security protocols in an effort to prevent incidents like this from occurring in the future.

We are also making resources available to those individuals whose information was involved. While we have no reason to believe that your information was used for any fraudulent purpose as a result of this incident, to help protect your identity, we are providing you with access to Experian IdentityWorksSM credit monitoring and remediation services for 24 months at no charge to you.

To enroll in these services at no charge, visit https://www.experianidworks.com/plus and follow the instructions provided. When prompted please provide the following unique code to receive services: BCV7SX55S. In order for you to receive the monitoring services described above, you must enroll by August 30, 2024. Please note that when signing up for monitoring services, you may be asked to verify personal information for your own protection to confirm your identity.

Should you have any questions regarding the Credit Monitoring services, have difficulty enrolling, or require additional support, please contact Experian at 1-833-918-1728. Be prepared to provide engagement number B123302 as proof of eligibility for the Identity Restoration services by Experian.

What You Can Do
To help protect your personal information, we strongly recommend you take the following steps, all of which are good ideas in any event:

• Carefully review statements sent to you by your bank, credit card company, or other financial institutions as well as government institutions like the Internal Revenue Service (IRS). Notify the sender of these statements immediately by phone and in writing if you detect any suspicious transactions or other activity you do not recognize.
• The Reference Guide below describes additional steps that you can take and provides resources for additional information. We encourage you to read and follow these steps as well.

For More Information
If you have questions or concerns or learn of any suspicious activity that you believe may be related to this incident, please call 1-833-918-1728 from 8:30 am – 5:30 pm US Eastern Time. Please know that we take this matter very seriously, and we apologize for any concern and inconvenience this may cause you.  

REFERENCE GUIDE

If you suspect that you are a victim of identity theft or credit fraud, we encourage you to remain vigilant and consider taking the following steps:

Order Your Free Credit Report.  To order your free credit report, visit www.annualcreditreport.com, call toll-free at 877-322-8228, or complete the Annual Credit Report Request Form on the U.S. Federal Trade Commission’s website at www.ftc.gov and mail it to Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348-5281.  Do not contact the three credit bureaus individually; they provide your free report only through the website or toll-free number.

When you receive your credit report, review the entire report carefully.  Look for any inaccuracies and/or accounts you don’t recognize and notify the credit bureaus as soon as possible if there are any.
You have rights under the federal Fair Credit Reporting Act (“FCRA”).  These include, among others, the right to know what is in your file; to dispute incomplete or inaccurate information; and to have consumer credit reporting agencies correct or delete inaccurate, incomplete, or unverifiable information.  For more information about the FCRA, please visit https://www.consumer.ftc.gov/articles/pdf-0096-fair-credit-reporting-act.pdf or www.ftc.gov

Place a Fraud Alert on Your Credit File:  To protect yourself from possible identity theft, consider placing a fraud alert on your credit file.  A fraud alert helps protect you against the possibility of an identity thief opening new credit accounts in your name.  When a merchant checks the credit history of someone applying for credit, the merchant gets a notice that the applicant may be a victim of identity theft.  The alert notifies the merchant to take steps to verify the identity of the applicant.  You can report potential identity theft to all three of the major credit bureaus by calling any one of the toll-free fraud numbers below.  You will reach an automated telephone system that allows you to flag your file with a fraud alert at all three bureaus.

Place a Security Freeze on Your Credit File.  You have the right to place a “security freeze” on your credit file.  A security freeze generally will prevent creditors from accessing your credit file at the three nationwide credit bureaus without your consent.  You can request a security freeze free of charge by contacting the credit bureaus using the same contact information noted above.
The credit bureaus may require that you provide proper identification prior to honoring your request.  In order to request a security freeze, you will need to provide the following information:

1. Your full name (including middle initial as well as Jr., Sr., II, III, etc.)
2. Social Security number
3. Date of birth
4. If you have moved in the past five (5) years, provide the addresses where you have lived over the prior five years.
5. Proof of current address, such as a current utility bill or telephone bill
6. A legible photocopy of a government issued identification card (state driver’s license or ID card, military identification, etc.)
7. If you are a victim of identity theft, include a copy of either the police report, investigative report, or complaint to law enforcement agency concerning identity theft.

Placing a security freeze on your credit file may delay, interfere with, or prevent timely approval of any requests you make for credit, loans, employment, housing or other services.  For more information regarding credit freezes, please contact the credit reporting agencies directly. 

Contact the U.S. Federal Trade Commission.  If you detect any incident of identity theft or fraud, promptly report the incident to your local law enforcement authorities, your state Attorney General and the Federal Trade Commission (“FTC”).  If you believe you identity has been stolen, the FTC recommends that you take these additional steps.

• Close the accounts that you have confirmed or believe have been tampered with or opened fraudulently.  Use the FTC’s ID Theft Affidavit (available at www.ftc.gov/idtheft) when you dispute new unauthorized accounts.

• File a local police report.  Obtain a copy of the police report and submit it to your creditors and any others that may require proof of the identity theft crime.

You can learn more about how to protect yourself from becoming an identity theft victim (including how to place a fraud alert or security freeze) by contacting the FTC:
        Federal Trade Commission
        Consumer Response Center
        600 Pennsylvania Avenue, NW
        Washington, DC 20580
        1-877-IDTHEFT (438-4338)
        www.ftc.gov/idtheft
 
For District of Columbia Residents:  You can obtain information from the FTC and the Office of the Attorney General for the District of Columbia about steps to take to avoid identity theft.  You can contact the D.C. Attorney General at: 441 4th Street, NW, Washington, DC 200001, 202-727-3400, www.oag.dc.gov

For Iowa Residents:  State law advises you to report any suspected identity theft to law enforcement or to the Attorney General.

For Maryland Residents:  You can obtain information from the Maryland Office of the Attorney General about steps you can take to help prevent identity theft.  You can contact the Maryland Attorney General at: 200 St. Paul Place, Baltimore, MD 21202, 888-743-0023, www.oag.state.md.us

For Massachusetts Residents:  You have a right to request from us a copy of any police report filed in connection with this incident.  If you are the victim of identity theft, you also have the right to file a police report and obtain a copy of it.  As noted above, you also have the right to place a security freeze on your credit report at no charge.

For New York Residents:  You may also contact the following state agencies for information regarding security breach response and identity theft prevention and protection information:

New York Attorney General’s Office

Bureau of Internet and Technology

(212) 416-8433

https://ag.ny.gov/internet/resource-center

NYS Department of State's Division of Consumer Protection

(800) 697-1220

https://www.dos.ny.gov/consumerprotection

For North Carolina Residents:  You can obtain information from the Federal Trade Commission and the North Carolina Office of the Attorney General about steps you can take to help prevent identity theft.  You can contact the North Carolina Attorney General at: 9001 Mail Service Center, Raleigh, NC 27699, 1-877-566-7226, www.ncdoj.gov

For Oregon Residents:  State laws advise you to report any suspected identity theft to law enforcement, as well as the Federal Trade Commission.  You can contact the Oregon Attorney General at: Oregon Department of Justice, 1162 Court Street NE, Salem, OR 97301-4096, (877) 877-9392, www.doj.state.or.us

For Rhode Island Residents:  You can obtain information from the Rhode Island Office of the Attorney General about steps you can take to help prevent identity theft.  You can contact the Rhode Island Attorney General at: 150 South Main Street, Providence, RI 02903, (401) 274-4400, www.riag.ri.gov.  As noted above, you have the right to place a security freeze on your credit report at no charge but note that consumer reporting agencies may charge fees for other services.