Express Scripts said it immediately notified the Federal Bureau of Investigation, which is investigating, and it notified the customers named in the letter last week.NEW YORK (Reuters) - Express Scripts said on Thursday it received an extortion letter threatening to expose
millions of patient records and warned of a "potential large data
breach."
The letter, which was sent to the pharmacy benefit manager in early
October from "an unknown person or persons," contained information on
75 Express Scripts customers, including names, dates of birth, social
security numbers and, in some cases, prescription information.
The large U.S. pharmacy benefit manager would be the latest company
to face a major data breach in recent years, following discount
retailer TJX Cos and Bank of New York Mellon Corp among others.
Express Scripts said it immediately notified the Federal Bureau of
Investigation, which is investigating, and it notified the customers
named in the letter last week.
The St. Louis-based company, which handles about 500 million
prescriptions a year, said it is also conducting its own investigation
with the help of outside experts in data security and computer
forensics.
Express Scripts spokesman Steve Littlejohn said the company delayed
publicizing the letter to allow the investigation to take shape, but it
had now reached a stage where the company wanted to make it public.
Chief Executive Officer George Paz called the threat "outrageous" and said the company was taking it "very seriously."
"We are cooperating with the FBI and are committed to doing what we can
to protect our members' personal information and to track down the
person or persons responsible for this criminal act," Paz said in a
statement.
An FBI spokesman in St. Louis said the agency was contacted by Express
Scripts but the spokesman could not comment on whether a probe had
begun.
Express Scripts uses a variety of systems designed to protect
customers' personal information from unauthorized access, but "as
security experts know, no data system is completely invulnerable," Paz
said.
Express Scripts said it launched a Web site -- www.esisupports.com --
for customers seeking information about the security incident and to
access resources and information to protect themselves against possible
identity theft.
A February report found that Americans lost $45.3 billion to identity
theft in 2007, but those losses declined 11 percent from the year
before.
Express Scripts shares closed down $3.85, or 6.2 percent, at $57.93 on Nasdaq on a down day for the overall markets.
(Reporting by Lewis Krauskopf; Editing by Andre Grenon, Leslie Gevirtz)
© Thomson Reuters 2008 All rights reserved
Online Media 
