HackingHealthcareProfessional ServicesHealthcareStolen CredentialsData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedFinancial accountHealth (basic)Identity (basic)Government IDPIIMediumContained

Express Scripts, Inc.

bd_ad7203999f9b496c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 2, 2025

Filed

May 5, 2026

To disclose

14 months

Affected

41state residents only

Confidence

66%

Full breach record for Express Scripts, Inc. →6 incidents on file

Berkeley Research Group (BRG), a third-party vendor for Express Scripts, experienced a data breach from Feb 28 to Mar 2, 2025. An unauthorized actor accessed BRG systems and copied personal information of Express Scripts clients. BRG contained the incident, rotated credentials, and rebuilt systems. Affected individuals received 24 months of credit monitoring via Kroll. Federal law enforcement was notified.

J jump to incidentP pin to compareR raw source

Massachusetts clock✗ MA AG >90d14 months discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 2 days

discovery → filing · 14 months / 429 days

Feb 28, 2025

Begins

Mar 2, 2025

Discovered

May 5, 2026

Filed

vs. sector median

+49 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed41 affectedView incident

Name: Berkeley Research Group, LLC
norm: berkeley research group
Domain: visitberkeley.com
Industry: professional_services

Name: Express Scripts, Inc.
norm: express scripts
Domain: express-scripts.com
Industry: healthcare
Industry: HealthcarellmProfessional Servicesllm

Discovered: Mar 2, 2025
Breach occurred: Feb 28, 2025 – Mar 2, 2025
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 41state-resident count only
Data types: Financial accountHealth (basic)Identity (basic)Government IDPII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: cooperating with federal law enforcementreporting this matter to additional authorities
Third party: via Berkeley Research Group, LLCvendor
Initial access: valid_credentials

During the incident: Deployed enhanced endpoint threat detection
Rotated user credentials
Rebuilding impacted systems
Cooperating with federal law enforcement
Reporting this matter to additional authorities
Secured the services of Kroll to provide identity monitoring
Changes made: Rebuilding impacted systems only once advised by cybersecurity experts it was safe to do so
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 months(429 days from discovery to filing)
Compliance flags: MA AG >90d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-697-massachusetts-mutual-life-insurance-company/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 5, 2026
Raw hash: 583f13a73867ba7820a7214ee6cf30fb4ff059ee6b7f264a454dc4b35446dbc8

Reporting entityBerkeley Research Group, LLC

Victim entityExpress Scripts, Inc.

Incidentdiscovered Mar 2, 2025

Stated responseDeployed enhanced endpoint threat detection

ComplianceMA AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov