The hackers that hit Sav-Rx late in 2023 made away with sensitive data on more than 2.8 million people in the United States, the company has confirmed in a filing with the Maine Attorney General.
Sav-Rx is a pharmacy benefit manager (PBM), a company that provides prescription drug benefit services to various organizations such as unions, employers, and health plans. Its work includes the management and facilitation of prescription medication delivery, negotiations with drug manufacturers and pharmacies regarding prices, and more.
In the filing, the company said that it suffered a data breach on October 8, 2023. Its first reaction was to secure its systems and make sure it restores operations as quickly as possible. Business resumed as usual the next day, and prescriptions were being shipped on time and without delay, the company said in the filing.
Names, addresses, and phone numbers
However, while it did secure its systems quickly with the help of a third-party security expert, it took its time with forensics and post-mortem. Eight months later, it concluded that the hackers stole its customers’ sensitive data:
"As part of the investigation, we learned that an unauthorized third party was able to access certain non-clinical systems and obtained files that contained personal information," Sav-Rx said.
The data that was exposed in this incident includes people’s full names, birth dates, Social Security Numbers (SSN), email addresses, postal addresses, phone numbers, eligibility data, and insurance identification number. While it’s commendable that clinical data was not accessed, the type of information stolen is more than enough for any hacking group to use in identity theft, phishing, or social engineering attacks.
Still, the company has now notified impacted individuals, BleepingComputer reports. It also set up a 24/7 security operations center, added multi-factor authentication to critical accounts, segmented its network, introduced geo-blocking, upgraded its firewalls, and more.
Furthermore, the affected customers were offered a two-year credit monitoring and identity theft protection service.
More from TechRadar Pro
- Another top WordPress plugin has a serious security flaw — patch now to keep your website safe
- Here's a list of the best firewalls today
- These are the best endpoint protection tools right now
