CENCORA INC
COR
Real Estate
4
exclusion reasons
3 themes
This page is part of our public exclusion list — a transparency tool that shows which companies we screen out and why. It is not investment advice, and it is not an accusation. But it is subject to change as our understanding of the facts evolves.
In August 2025, Cencora and its subsidiary The Lash Group agreed to a $40 million class-action settlement following a February 2024 cyberattack. The breach exfiltrated the data of over 1.43 million individuals, including Social Security Numbers, health diagnoses, and prescriptions. Plaintiffs alleged Cencora was negligent in its HIPAA duties and failed to notify victims in a timely manner (taking nearly three months to start notifications).
Lobbying disclosures from Q1 and Q2 2025 show Cencora spent hundreds of thousands of dollars targeting the FDA and Labor/HHS appropriations. Key focus areas include "Supply Chain Resiliency" and "DSCSA Implementation"—legislation designed to track drugs. Critics argue this lobbying is intended to secure "safe harbor" provisions that limit distributor liability for counterfeit or diverted drugs.
Cencora Inc., formerly AmerisourceBergen, operates as a major pharmaceutical wholesale and distribution company. The company has a documented pattern of regulatory violations across multiple domains, indicating systemic compliance failures. In February 2024, Cencora disclosed a significant data breach, which led to a $40 million settlement in related litigation finalized in August 2025. This incident followed a separate, ongoing lawsuit filed in May 2025 alleging widespread wage and hour violations in California, including failure to provide adequate rest periods and minimum wages.
The pattern extends beyond labor and data security. ViolationTracker documents additional enforcement actions against the company. While individual penalties may be statutorily capped, the recurrence of violations across distinct regulatory areas—workplace standards, data privacy, and securities disclosure—demonstrates a concerning failure to implement adequate internal controls. This multi-domain pattern meets the threshold for exclusion based on regulatory failures.
Cencora is currently paying out a $6.4 billion nationwide settlement (agreed in 2022, active through 2040) to resolve thousands of lawsuits alleging it failed to maintain effective controls against the diversion of prescription opioids. As of late 2025, federal courts have allowed certain additional "bellwether" cases to proceed, suggesting the company’s legal liability for the epidemic remains an active, non-finalized risk.
Research Sources
5 organizations
Related Exclusions
Wondering what we do invest in?
The Naughty List
A digest of changes to our exclusion list — new additions, removals, and the evidence behind them. We review the list continuously as new evidence surfaces.
Companies appear on our exclusion list based on our investment judgment — not because they've done anything illegal. This is a difference of values and opinion, not an accusation of wrongdoing. Exclusion does not constitute a recommendation against investing in any company, and absence from the list does not constitute a recommendation to invest.
This information is provided for educational and transparency purposes only and should not be relied upon as investment advice. Data is drawn from independent watchdogs, NGOs, government registries, and Ethical Capital's ongoing research — see Research Sources for the full list.
Ethical Capital LLC is a state-registered investment adviser in Utah (CRD #316032). Registration does not imply a certain level of skill or training.