Express Scripts, Inc. data breach (2022)

💎Delaware State AG

Filed May 30, 2022bd_692ca0e73337b6e0

Express Scripts notified members of unauthorized access to their Express Scripts mobile application accounts between April 30 and May 3, 2022. A bad actor used credentials obtained from a separate breach (credential stuffing) to access accounts. Affected data included prescription history, medication names, and pharmacy information. Express Scripts locked affected accounts and required password resets. Members were offered free identity theft protection via Equifax.

🦬Montana State AGMost recentlinked via multistate filing link · 95%

Filed Jul 10, 2022bd_8ae6086e173bb504

Express Scripts reported a data breach to the Montana Attorney General. The breach was reported on 2022-07-10. The breach occurred on 4/30/2022. 2 Montana residents were affected.

Affected (this filing): 2

🦬Montana State AGlinked via multistate filing link · 95%

Filed Jun 1, 2022bd_c05ac047f6d07013

Express Scripts reported a data breach to the Montana Attorney General. The breach was reported on 2022-06-01. The breach occurred on 4/30/2022. 36 Montana residents were affected.

Affected (this filing): 36

🐻California State AG

Filed Jun 3, 2022bd_ced8b9f8cc34a516

Express Scripts, Inc. reported a cybersecurity incident involving unauthorized access to its mobile application. Between April 30 and May 3, 2022, a bad actor used stolen credentials (user ID and password obtained from another breach) to access member accounts. The actor may have viewed prescription history for the last 24 months, including names, medication details, and pharmacy information. No financial data or SSNs were compromised. Express Scripts locked affected accounts and required password resets, and offered free identity theft protection via Equifax.

Express Scripts, Inc.

Litigation Timing

Timeline