Data Breach at Sav-Rx Prescription Services Firm Impacts 2.8 Million Individuals

Sav-Rx, a pharmacy prescription services provider operated by A&A Services, recently experienced a significant data breach affecting approximately 2.8 million individuals. The breach, detected on October 8, 2023, led to a temporary interruption of Sav-Rx's computer network, which was swiftly contained, allowing the company to restore the impacted systems by the next business day.

Sav-Rx assured that the disruption did not impede patient care or delay prescription deliveries. Their adjudication system, responsible for processing pharmacy claims, remained fully functional throughout the incident. However, the attackers accessed non-clinical systems, exfiltrating personal information. The compromised data includes names, addresses, birth dates, email addresses, phone numbers, Social Security numbers, eligibility data, and insurance identification numbers. Importantly, no clinical or financial information was compromised.

The Maine Attorney General’s office was notified, confirming the breach impacted 2,812,336 individuals. Sav-Rx has not disclosed whether file-encrypting ransomware was involved or identified the perpetrators. However, the notification letter implies that a ransom might have been paid to prevent the dissemination of stolen information.

Upon discovering the breach, Sav-Rx collaborated with external cybersecurity experts to investigate and contain the incident, ensuring that any acquired data was destroyed and not further distributed.

To mitigate the potential impact on affected individuals, Sav-Rx is offering two years of free credit monitoring and identity theft restoration services. They also urge those affected to be vigilant for any unusual activity in their accounts.

Sav-Rx serves as a pharmacy benefit manager (PBM), managing prescription drug programs for various health plans and organizations across the United States.