PharMerica Corporation pharmerica.com PharMerica data breach: what happened and what to do
PharMerica reported a March 2023 hacking incident that affected 5,815,591 people. Exposed data included names, addresses, dates of birth, Social Security numbers, claims information and medications. The company offered free credit monitoring.
View all 13,115 breaches- Breach date
- 12 Mar 2023
- Made public
- 12 May 2023
- Affected
- 5,815,591
- Data exposed
- Names, Physical addresses, Dates of birth, Social security numbers, Health insurance information, Medications
- Last updated
What happened
PharMerica, a pharmacy services company, told the US Department of Health and Human Services (HHS) that it had a hacking incident affecting the protected health information of 5,815,591 people. The breach was reported in May 2023, and the intrusion started around 12 March 2023.
The company notified HHS, affected individuals and the media, and posted a notice on its website. Security reporting said the Money Message ransomware group claimed the attack, but PharMerica's own notice did not name an attacker, so treat that part as a claim.
What was exposed
HHS's description of the case says the information included names, addresses, dates of birth, Social Security numbers, claims information and medications. Medication lists reveal conditions, and Social Security numbers are the key to identity theft.
A Social Security number paired with a name and birth date is enough to apply for credit or file a tax return in someone else's name. Medication details are useful for targeted scams that pretend to be a pharmacy or insurer.
The company's response
PharMerica said it offered free credit monitoring to affected people and put in place more administrative, technical and security safeguards. Reports say it was not aware of any fraud tied to the incident at the time of notice.
What this means for you
If you got a letter from PharMerica, take the credit monitoring offer, and freeze your credit. A freeze is free and works better than monitoring, since it stops new accounts from being opened.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
Because identity numbers were involved, place a free credit freeze at Equifax, Experian and TransUnion. A freeze stops anyone opening new credit in your name. Lift it temporarily when you apply for credit yourself.
- 2
Accept the free credit monitoring
If your notice letter included a monitoring code, use it before it expires. It alerts you to new accounts but doesn't block them, so keep the freeze too.
- 3
Read your insurance and pharmacy statements
Look for claims or prescriptions you don't recognise and report them to your insurer.
- 4
Be wary of calls about your medications
Scammers use real drug names to sound credible. Hang up and call the pharmacy or insurer on the number printed on your card.
- 5
File taxes early and get an IRS identity protection PIN
With a Social Security number exposed, request an Identity Protection PIN from the IRS so nobody else can file a return as you.
Frequently asked
Was I affected by the PharMerica breach?
PharMerica sent notice letters in 2023. If you received one, you were affected. HHS lists 5,815,591 people in total.
What was exposed?
Names, addresses, dates of birth, Social Security numbers, claims information and medications, per HHS's description.
Does PharMerica offer credit monitoring?
Yes, it offered free credit monitoring to affected individuals.
Should I freeze my credit?
Yes. Social Security numbers were involved, and a free freeze at the three bureaus blocks new accounts in your name.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
