Express Scripts, Inc.
bd_ced8b9f8cc34a516 · schema v1 · pii pii-v1
Full breach record for Express Scripts, Inc. →6 incidents on fileExpress Scripts, Inc. reported a cybersecurity incident involving unauthorized access to its mobile application. Between April 30 and May 3, 2022, a bad actor used stolen credentials (user ID and password obtained from another breach) to access member accounts. The actor may have viewed prescription history for the last 24 months, including names, medication details, and pharmacy information. No financial data or SSNs were compromised. Express Scripts locked affected accounts and required password resets, and offered free identity theft protection via Equifax.
J jump to incidentP pin to compareR raw source
Incident timeline
Apr 30, 2022
Begins
May 1, 2022
Discovered
Jun 3, 2022
Filed
vs. sector median
8 wks faster
Linked disclosures
Why this link?Regulatory filings (6) · sorted by filing gap
- Montana State AGbd_c05ac047f6d070132022-06-01 · +2dVerified
- Delaware State AGbd_692ca0e73337b6e02022-05-30 · +4dCandidate
- Montana State AGbd_8ae6086e173bb5042022-07-10 · +37dVerified
- Illinois State AGbd_49a4a002044791612023-01-01 · +212dVerified
Show 2 more filings ↓Show fewer ↑up to 212d gap
- Illinois State AGbd_90fb1332627303d92023-01-01 · +212dVerified
- Illinois State AGbd_e992370054ec45c52023-01-01 · +212dVerified
Filing propagation · 7 filings · 4 states
View merged incident ↗Pattern: first filing May 30 (DE), last Jan 1 (IL) — a 216-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.