HackingExtortion DemandStolen CredentialsRansom DemandedData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIDENTITY_GOVERNMENTIDENTITY_BASICHEALTH_BASICHighActive
Express Scripts, Inc.
bd_ddc1e8f0697289de · schema v1 · pii pii-v1
Full breach record for Express Scripts, Inc. →Supplemental state-AG notice from Express Scripts, Inc. (NH) regarding a 2008 extortion threat involving unauthorized access to member records. The incident affected 1,771 New Hampshire residents, exposing names, SSNs, DOBs, and some prescription data. The actor threatened to expose records. FBI was notified; investigation ongoing. Notifications sent Oct 28, 2008. Kroll Inc. contracted for identity restoration.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,771 affectedView incident
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/express-scripts-20090914.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Sep 14, 2009
- Raw hash
- ed9e7a37084a6d6f114fb4f19ec96d883ecc4c2c4c302d0d1741c01bc67545d2
Reporting entity
- Name
- Express Scripts, Inc.norm: express scripts
- Domain
- express-scripts.com
Victim entity
- Name
- Express Scripts, Inc.norm: express scripts
- Domain
- express-scripts.com
Incident
- Discovered
- Oct 1, 2008
- Materiality determined
- —
- Notification sent
- Oct 28, 2008
- Affected individuals
- 1,771
- Data types
- IDENTITY_GOVERNMENTIDENTITY_BASICHEALTH_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1486 Data Encrypted for ImpactT1078 Valid Accounts
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified New Hampshire Office of the Attorney GeneralSubmitted prior notification letter on November 12, 2008
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 50 weeks(348 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.