Hundreds of thousands of members of a pharmacy benefit management firm may have had their information exposed to extortionists.