Frequently Asked Questions
I heard about the unauthorized access of member data at Express Scripts. What happened?
In early October, Express Scripts received a letter from an unknown person or persons trying to extort money from the company. This unknown person or persons threatened to expose millions of the company’s members’ records on the Internet if an extortion threat was not met. The extortion letter included information on 75 members, including Social Security numbers, dates of birth, and in some cases, prescription information.
More recently, Express Scripts became aware that a small number of its clients had received letters threatening to expose additional member data. These letters are believed to be connected to the original extortion letter received by Express Scripts.
Who is Express Scripts and why do you have my personal information?
Express Scripts works with health benefit plans, processing millions of prescriptions each year through Home Delivery and at retail pharmacies.
As we are involved in processing employee prescription drug benefits, it is necessary for us to have access to personal information such as your name, member number and date of birth, and may also include prescription information.
Please know that we understand your concern about this situation. At Express Scripts, we are committed to protecting the privacy and security of our members’ information. We deploy a variety of security systems and procedures to protect that information from unauthorized access. However, as security experts know, no data system is completely invulnerable.
What are you doing about it?
We’re offering our members free identity restoration services if they become victims of identity theft because of this incident. These services will be provided by Kroll, a New York-based risk-consulting firm and global data security leader. Read more.
We’re in the process of notifying our members and clients to enable them to take steps to protect themselves from possible identity theft.
We have notified the members whose information appeared in the extortion letter. We notified the FBI immediately after we received the letter and they continue to investigate. Additionally, we launched our own investigation with the assistance of outside experts in data security and computer forensics.
We’re establishing a reward totaling $1 million for the person or persons who provide information resulting in the arrest and conviction of those responsible for these criminal acts. Anyone with information about the extortion threats should contact the FBI at 800-CALL-FBI.
We want to reassure you that we are doing what we can to secure their data and identify those responsible.
How did it happen?
We believe we have identified where the data involved in this situation was stored in our systems and have instituted enhanced controls. We are continuing our investigation to identify those responsible for any unauthorized access.
Should I feel confident about using your website for refills and other transactions?
Yes. We have put enhanced security processes in place.
How do I know if my company received an extortion letter?
We are notifying all our clients and the members whose data was listed in the extortion letters.
Has the data that was accessed been used for identity theft?
Not to our knowledge. Our investigations are ongoing.
How will you notify me if you find out if my records have been accessed?
Express Scripts will notify in compliance with state regulations. The best way for you to receive personal notification, if needed, is to log into our secure member website to update your email address. If you are not currently registered, please visit our member website to activate your account.
How can I protect myself & my family?
We’re offering our members free identity restoration services if they become victims of identity theft because of this incident. These services will be provided by Kroll, a New York-based risk-consulting firm and global data security leader. Read more.
You can also get information about credit monitoring services by visiting the following websites:
www.equifax.com
www.transunion.com
www.experian.com
www.annualcreditreport.com
Should you find any suspicious activity on your credit report or have reason to believe your information is being misused, contact your local law enforcement agency and file a police report.
There is important information about preventing identity theft on the Federal Trade Commission’s website. www.consumer.gov/idtheft
If you suspect you have been the victim of Medicare/Medicaid fraud, call 1-800-HHS-TIPS (1-800-447-8477)
