In March 2023, PharMerica, a major pharmacy services provider, experienced a data breach involving unauthorized access to their computer systems. The breach was carried out by the Money Message ransomware group, who claimed to have exfiltrated a significant amount of data. PharMerica faced a class-action lawsuit for allegedly failing to notify consumers about the breach for over two months. The incident has been reported as one of the largest healthcare data breaches in 2023.

How many accounts were compromised?

The breach impacted data related to approximately 5.8 million individuals.

What data was leaked?

The data exposed in the breach included health records, prescription information, Social Security numbers, dates of birth, addresses, and insurance details.

How was PharMerica hacked?

The Money Message ransomware group breached PharMerica's computer systems, exfiltrating databases containing personal and medical information of 5,815,591 individuals. The specific methods used by the hackers remain undisclosed. PharMerica isolated its network, conducted an investigation, and implemented additional cybersecurity safeguards to prevent similar incidents in the future. Affected individuals were notified and offered complimentary credit monitoring and identity theft protection services for 12 months.

PharMerica's solution

In response to the hack, PharMerica took several measures to secure its platform and prevent future incidents. This included isolating its network, conducting a thorough investigation with the assistance of third-party cybersecurity experts, and implementing additional technical cybersecurity safeguards. PharMerica also notified affected individuals, providing them with information on steps they can take to protect themselves against potential fraud or identity theft, and arranged for complimentary identity protection and credit monitoring services for potentially affected individuals for 12 months.

How do I know if I was affected?

PharMerica notified affected individuals and provided them with information on steps they can take to protect themselves against potential fraud or identity theft. If you believe you may have been affected by the PharMerica breach but have not received a notification, you can visit Have I Been Pwned to check if your credentials were affected.

What should affected users do?

In general, affected users should:

1. Change Your Passwords: Immediately update your passwords for any accounts that may have been affected. Make sure the new passwords are strong and unique, not previously used on any other platform.

2. Reset Passwords for Other Accounts: If you've used the same or similar passwords for other online accounts, reset those as well. This is crucial as attackers often try using stolen passwords on multiple sites.

3. Enable Two-Factor Authentication (2FA): Activate 2FA on any affected accounts. Consider enabling this additional security feature on all other important online accounts to significantly reduce the risk of unauthorized access.

For more specific help and instructions related to the PharMerica data breach, please contact PharMerica Customer Support directly.

Where can I go to learn more?

If you want to find more information on the PharMerica data breach, check out the following news articles:

• Data Privacy Incident - Pharmerica

• Almost 6 Million Individuals Affected by PharMerica Data Breach

• PharMerica Neglected to Tell Consumers About Data Breach for 2 Months: Lawsuit