HackingHealthcareFinancial ServicesHealthcareData ExfiltratedRansom DemandedCustomer Data InvolvedGovernment IDIdentity (basic)Health (basic)HighActive

Express Scripts, Inc.

bd_ddc1e8f0697289de · schema v1 · pii pii-v1

Severity

High

Discovered

—

Filed

Sep 14, 2009

To disclose

—

Affected

1,771state residents only

Confidence

66%

Full breach record for Express Scripts, Inc. →6 incidents on file

Express Scripts, Inc. notified the NH Attorney General of additional information regarding a 2008 incident where an unknown party threatened to expose member records to extort money. The FBI investigation revealed unauthorized access to names, SSNs, and dates of birth for approximately 1,771 New Hampshire residents. The company is cooperating with law enforcement and providing identity restoration services via Kroll Inc.

J jump to incidentP pin to compareR raw source

Incident timeline

Oct 1, 2008

Begins

Sep 14, 2009

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,771 affectedView incident

Name: Express Scripts, Inc.
norm: express scripts
Domain: express-scripts.com

Name: Express Scripts, Inc.
norm: express scripts
Domain: express-scripts.com
Industry: HealthcarellmFinancial Servicesllm

Discovered: —
Breach occurred: Oct 1, 2008 – Oct 31, 2008
Materiality determined: —
Notification sent: Sep 14, 2009
Affected individuals: 1,771state-resident count only
Data types: Government IDIdentity (basic)Health (basic)
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unknown
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified the Office of the Attorney General of New HampshireNotified the FBI

During the incident: Notified the FBI
Cooperating with law enforcement authorities and their ongoing criminal investigation
Conducting an investigation with the help of outside experts in data security and computer forensics
Issued press releases dated November 6 and 11, 2008
Launched a website, www.esisupports.com, to notify our clients and members
Contracted with Kroll Inc. to provide identity restoration services
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/express-scripts-20090914.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 14, 2009
Raw hash: ed9e7a37084a6d6f114fb4f19ec96d883ecc4c2c4c302d0d1741c01bc67545d2

Reporting entityExpress Scripts, Inc.

Victim entityExpress Scripts, Inc.

IncidentUnknown

Stated responseNotified the FBI

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov