Attackers Hold Millions of Patient Records For Ransom

Attackers are threatening to expose millions of patient records maintained by a company in the pharmaceutical industry unless the company pays a ransom.

Express Scripts, one of the largest pharmacy benefit management companies in North America, on Thursday reported it had received an extortion letter that included personal information of 75 members, including their names, dates of birth, Social Security numbers, and, in some cases, their prescription information.

The letter was received early last month, Express Scripts said. The company has notified the 75 affected members, as well as the FBI, and is now conducting its own investigation with the help of outside experts in data security and computer forensics.

"We have been conducting a thorough investigation since we received this threat, and we are taking it very seriously," said George Paz, chairman and CEO. "Express Scripts is committed to the privacy and security of our members' personal information, so a threat like this against our members is outrageous."

Express Scripts said it deploys "a variety of security systems" designed to protect its members' personal information from unauthorized access. "However, as security experts know, no data system is completely invulnerable," Paz said. "We continue to conduct our investigation. We are notifying our members and clients to enable them to take steps to protect themselves from possible identity theft."

Express Scripts has launched a Website for members to obtain information about the threat and to access resources and information to help them protect themselves against the possibility of identity theft.