Express Scripts reports extortion over data breach

NEW YORK (Reuters) - Express Scripts Inc ESRX.O said on Thursday it received an extortion letter threatening to expose millions of patient records and warned of a "potential large data breach."

The letter, which was sent to the pharmacy benefit manager in early October from “an unknown person or persons,” contained information on 75 Express Scripts customers, including names, dates of birth, social security numbers and, in some cases, prescription information.

The large U.S. pharmacy benefit manager would be the latest company to face a major data breach in recent years, following discount retailer TJX Cos TJX.N and Bank of New York Mellon Corp BK.N among others.

Express Scripts said it immediately notified the Federal Bureau of Investigation, which is investigating, and it notified the customers named in the letter last week.

The St. Louis-based company, which handles about 500 million prescriptions a year, said it is also conducting its own investigation with the help of outside experts in data security and computer forensics.

Express Scripts spokesman Steve Littlejohn said the company delayed publicizing the letter to allow the investigation to take shape, but it had now reached a stage where the company wanted to make it public.

Chief Executive Officer George Paz called the threat “outrageous” and said the company was taking it “very seriously.”

“We are cooperating with the FBI and are committed to doing what we can to protect our members’ personal information and to track down the person or persons responsible for this criminal act,” Paz said in a statement.

An FBI spokesman in St. Louis said the agency was contacted by Express Scripts but the spokesman could not comment on whether a probe had begun.

Express Scripts uses a variety of systems designed to protect customers’ personal information from unauthorized access, but “as security experts know, no data system is completely invulnerable,” Paz said.

Express Scripts said it launched a Website -- -- for customers seeking information about the security incident and to access resources and information to protect themselves against possible identity theft.

A February report found that Americans lost $45.3 billion to identity theft in 2007, but those losses declined 11 percent from the year before.

Express Scripts shares closed down $3.85, or 6.2 percent, at $57.93 on Nasdaq on a down day for the overall markets.

Reporting by Lewis Krauskopf; Editing by Andre Grenon, Leslie Gevirtz