$1 million reward for arrest of cyberextortionists

Share this article:
A pharmacy benefits management firm announced Tuesday that it is offering a $1 million reward for information leading to the conviction of whomever is threatening to divulge the personal information of millions of its members.

St. Louis-based Express Scripts disclosed last week it received an anonymous letter that included the names, Social Security numbers, birth dates and, in some cases, prescription information of 75 members. The writer or writers threatened to release millions more of similar records if the business failed to pay an unspecified sum of money.

Meanwhile, the company also revealed on Tuesday that a number of its clients have received letters threatening to expose the same confidential data.

Express Scripts has roughly 50 million members and several thousand clients, which includes employers, government programs, managed-care organizations and unions, said Steve Littlejohn, a company spokesman.

The company has yet to determine the cause of the breach but has isolated from where in its databases the information was lifted, he said.

"What we know is that these criminals that have been sending these letters have included information in the letters that would indicate a breach," Littlejohn said.

Bill Bartow, vice president of product management at data security solutions provider Tizor Systems, said the incident smells like an inside job.

"Someone got to their database," he told SCMagazineUS.com on Wednesday. "Typically when you get to that level, it's an insider or someone with stolen or compromised credentials."

Bartow said safeguarding the database is often ignored by businesses, and he stressed the need for stronger authentication and monitoring solutions.

Littlejohn said Express Scripts is not responding to the demand and continues a round-the-clock investigation. In addition, the company is offering members free identity-theft services if they become victims.

"You can't tolerate crimes like this in our data-rich business environment," he said.

Anyone with information should contact the FBI at (800) CALL-FBI (225-5324). A spokesman for the agency's St. Louis field office could not be reached for comment on Wednesday.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

More in News

Reported breaches involving zero-day bug at JPMorgan Chase, other banks

Reported breaches involving zero-day bug at JPMorgan Chase, ...

Hackers exploited a zero-day vulnerability and gained access to sensitive information from JPMorgan Chase and at least four other financial institutions, reports indicate.

Data on 97K Bugzilla users posted online for about three months

During a migration of the testing server for test builds of Bugzilla software, data on about 97,000 Bugzilla users was inadvertently posted publicly online.

Chinese national had access to data on 5M Arizona drivers, possible breach ...

Although Lizhong Fan left the U.S. in 2007, the agencies responsible for giving him access to Americans' personal information have yet to disclose the details of the case to the public.