Express Scripts - Information Breach

Information Breach

in October 2008, the St. Louis headquarters received an anonymous letter that contained names, Social Security numbers, birth dates and some prescription information of 75 members. The cyberextortionist stated that they had millions more of similar records and would release them if the company failed to pay an unspecified amount of money. Clients associated with the company also received similar threatening letters. A $ 1 million award was offered by the pharmacy benefits management firm for any information that would lead to the conviction of the individual or group.

By November, about 700,000 clients were notified that their information may have been compromised. A consumer class action lawsuit against Express Scripts was brought on by John Amburgy, a Missouri man who accused the company of negligence in protecting customer records. He also accused the company of breach of contract, breach of implied contract, and violations of data breach notification laws in various states. Amburgy claimed that due to the data breach, he and various others affected by the incident were at increased risk of identity theft and extortion. However, Amburgy failed to show how he was directly affected by the breach and the lawsuit was dismissed.