Pharmaceutical company leaks private information of 2.8 million Americans

Sav-Rx, a US-based pharmaceutical service provider, is warning over 2.8 million people in the United States that a data breach took place.

On April 30 2024, the company discovered an interruption to their network. To minimize the damage and secure their IT systems, Sav-Rx employees immediately took steps.

Thanks to the quick intervention, all computer systems were restored the next business day. Prescriptions were shipped on time without delay.

An investigation conducted by third party cybersecurity experts showed that an unauthorized party was able to access non-clinical systems, probably on or around October 3 2023.

Company asks affected people to be vigilant

The attackers were able to exfiltrate a plethora of data, such as full names, date of births, social security numbers, email addresses, physical addresses, phone numbers and insurance identification numbers. Sav-Rx emphasizes the threat actor did not have access to clinical or financial information.

“We have taken a number of steps to enhance our security protocols and controls, technology, and training. We also continue to assess further options to protect our IT System. Additionally, we promptly notified law enforcement authorities”, the pharmaceutical company says in a FAQ page.

According to a data breach notification to the Maine Attorney General, 2,812,336 clients were affected by the data breach. They have been notified about the incident.

So far, there’s been no evidence that the threat actor made use of any personal information as a result of the security incident, or that the data appeared on the dark web. Out of caution, Sav-Rx offers all affected people free credit monitoring and identity theft protection for two years.

The company recommends to be vigilant for incidents of fraud and identity theft. “Promptly report any fraudulent activity or any suspected incidents of identity theft to the applicable bank or other financial institution holding accounts, as well as any appropriate authorities, such as state attorneys general and the Federal Trade Commission (FTC)”, it says.