PharMerica Data Breach Leads to Leaked Medical Data of 5.8 Million Patients

The second largest institutional pharmacy services company in the United States, PharMerica, has suffered a data breach and sent out notifications on May 12, 2023. The company reported that they had discovered suspicious activity in their network on March 14, 2023, after the unknown third-party had already been in the breached computer system for two (2) days. After the discovery, PharMerica immediately hired a security company to conduct an investigation who, after one (1) week, concluded that the breached data contained the personal information of 5.8 million individuals. The data included victims’ names, addresses, dates of birth, Social Security numbers (SSNs), as well as medications and health insurance information. There is an underlying potential here for deceased victims’ information being used to open credit cards or take out loans; however, Maine regulators have extended Experian identity protection services to victims for one (1) year to help prevent such possibilities. While PharMerica has yet to release additional information about attack specifics or attribution speculations, the Money Message ransomware group posted the company on their leak site on March 28, 2023, claiming to have stolen 4.7 terabytes of data that was then officially published on their leak site on April 7, 2023. The data has since been seen on additional hacker forums and has been posted on the clear net, broken down into thirteen (13) sections for greater ease of downloading. This is the latest attack in recent months on healthcare giants, a hot target for the beginning of 2023.