Express Scripts, Inc.
bd_692ca0e73337b6e0 · schema v1 · pii pii-v1
Full breach record for Express Scripts, Inc. →6 incidents on fileExpress Scripts notified members of unauthorized access to their Express Scripts mobile application accounts between April 30 and May 3, 2022. A bad actor used credentials obtained from a separate breach (credential stuffing) to access accounts. Affected data included prescription history, medication names, and pharmacy information. Express Scripts locked affected accounts and required password resets. Members were offered free identity theft protection via Equifax.
J jump to incidentP pin to compareR raw source
Incident timeline
Apr 30, 2022
Begins
May 1, 2022
Discovered
May 30, 2022
Filed
vs. sector median
8 wks faster
Linked disclosures
Why this link?Regulatory filings (6) · sorted by filing gap
- Montana State AGbd_c05ac047f6d070132022-06-01 · +2dVerified
- California State AGbd_ced8b9f8cc34a5162022-06-03 · +4dCandidate
- Montana State AGbd_8ae6086e173bb5042022-07-10 · +41dVerified
- Illinois State AGbd_49a4a002044791612023-01-01 · +216dVerified
Show 2 more filings ↓Show fewer ↑up to 216d gap
- Illinois State AGbd_90fb1332627303d92023-01-01 · +216dVerified
- Illinois State AGbd_e992370054ec45c52023-01-01 · +216dVerified
Filing propagation · 7 filings · 4 states
View merged incident ↗Pattern: first filing May 30 (DE), last Jan 1 (IL) — a 216-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.