Express Scripts express-scripts.com Express Scripts data breach: what happened and what to do
Express Scripts said someone used valid logins to get into member accounts through its mobile app between April 30 and May 3, 2022. The person could have seen up to 24 months of prescription history, including names, medications, doctors and pharmacies. No total was published.
View all 13,115 breaches- Breach date
- 30 Apr 2022
- Made public
- 3 Jun 2022
- Data exposed
- Names, Prescription history
- Last updated
What happened
Express Scripts, a pharmacy benefit company, noticed suspicious activity in its mobile app during system monitoring. According to its notice to members, someone logged in with correct usernames and passwords on or around April 30, 2022, and the company flagged it as suspicious on May 1. A notice reported by news outlets puts the unauthorized access between April 30 and May 3.
Nobody broke into Express Scripts' servers. The company said it believed the person got the user IDs and passwords from publicly available data from another organization's breach and tried them in the app. That's called credential stuffing: attackers take logins leaked from one site and try them on others, betting that people reuse passwords.
The company reported the incident to the California Attorney General on June 3, 2022 and posted notices with other states. Express Scripts did not publish a total number of affected members.
What was exposed
While logged in, the person could have seen prescription history from the previous 24 months: member names, medication names, doctors' names, prescription numbers and dosages, and pharmacy names. The notice doesn't mention Social Security numbers or payment cards.
Prescription history is sensitive in its own right, and it's useful for phishing. A message that names your pharmacy and a drug you take looks like it came from your health plan.
The company's response
Express Scripts locked the affected accounts and told members to change passwords on any account that used the same login.
What to do
The fix is the same for any credential stuffing attack: stop reusing passwords. The steps below cover it.
What to do if you were in it
- 1
Change your Express Scripts password
Pick a new, unique one. If you used the same login on any other site, change it there too.
- 2
Use a password manager
The attack worked because logins from one breach opened an account somewhere else. A password manager gives every site its own password.
- 3
Turn on two-factor login
Where the app or site offers it, use an authenticator app or passkey so a leaked password alone can't open your account.
- 4
Expect phishing that mentions your prescriptions
Don't act on messages that cite a medication or a pharmacy and ask you to click or call. Contact your plan using the number on your insurance card.
- 5
Check whether your email or phone is in this and other breaches
A free Serus scan checks breach databases for your email and phone number and tells you what to do next. Serus can't remove breach data, but it alerts you when your details show up.
Frequently asked
Was I affected by the Express Scripts breach?
If you got a notice from Express Scripts in mid-2022, yes. No total was published, so there isn't a public count.
What was exposed?
Up to 24 months of prescription history: names, medication names, doctors' names, prescription numbers, dosages and pharmacy names.
Were Social Security numbers or cards exposed?
The notice describes prescription history only and doesn't list Social Security numbers or payment cards.
Should I change my password?
Yes. Change it on Express Scripts and on every other site where you used the same one.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
