Express Scripts offers $1 million award to nab extortionist in data breach case

Express Scripts, the pharmacy benefits management company which recently disclosed an extortionist is demanding money by threatening to expose millions of patient records the company holds, Wednesday said it has decided to offer $1 million to nab the perpetrator.

“We’re going on the offense with this reward,” says Steve Littlejohn, Express Scripts spokesman and vice president of public affairs. The $1 million will be paid to anyone who provides information leading to the capture and conviction of the extortionist who sent a letter to Express Scripts in early October that contained personal information on 75 people, considered members, who use the company’s pharmacy-benefits services. The extortionist claims to have information on millions more Express Scripts members and wants money to not reveal it.

Express Scripts has refused to cave in to the extortionist’s demand. But Littlejohn said that now a small number of its clients, such as companies offering healthcare plans to employees, are also now receiving extortion threats with personal information about members. “The letters are similar enough that we are inclined to think it’s the same person,” says Littlejohn.

He says Express Scripts and its clients are agreeing not cave in to the extortionist’s demand for money.

Express Scripts, which is working with the FBI, is investigating how the company may have suffered a data breach, whether it might be an inside attack or outsider crime. “We have a 24 x 7 investigation underway,” Littlejohn says. “We’re not excluding anything.”

For more information about the extortionist demands and the data breach to The Express Scripts Web site.

Read more about security in Network World's Security section.