A data breach at Truepill, which fulfills mail order prescriptions for pharmacies, has exposed the personal information of more than 2.3 million patients, according to the company, which is also known as Postmeds.
The cybersecurity incident involved patient information including their names, medication type and in some instances demographic information and/or their prescribing physician's name, according to a notice on the company's website. Truepill said it began to mail those affected by the incident on October 30.
The company did not immediately respond to requests for comment.
Subscribe to Kiplinger’s Personal Finance
Be a smarter, better informed investor.
Save up to 74%
Sign up for Kiplinger’s Free E-Newsletters
Profit and prosper with the best of expert advice on investing, taxes, retirement, personal finance and more - straight to your e-mail.
Profit and prosper with the best of expert advice - straight to your e-mail.
The incident is part of a growing list of cyber attacks in the healthcare sector, which has led to the exposure of personal information of millions of patients.
Truepill said that it discovered on August 31 that a bad actor gained access to a subset of files used for pharmacy management and fulfillment services. Following an immediate investigation, it determined that the files were accessed between August 30 and September 1.
In a filing on the Department of Health and Human Services’ breach portal, Postmeds said that 2.36 million individuals were impacted by the hack. The company said that it has enhanced “security protocols and technical safeguards” and is implementing training for its employees to prevent another incident.
"We also encourage affected individuals to regularly review their information for accuracy, as a best practice, including information they receive from their healthcare providers," the company said.
If you are a Truepill patient and have questions about the hack, the company says you can contact its confidential call center at 1-855-457-9143, Monday through Friday.
A “foreseeable and preventable” hack
A class action lawsuit over the incident has already been filed against PostMeds. The suit claims that the incident was “foreseeable and preventable” and was a direct result of the company's failure to implement adequate data security measures to safeguard information.
The hack and suit follow Truepill's settlement with the Drug Enforcement Administration (DEA). With the settlement, Truepill accepted responsibility for operating unregistered online pharmacy, filling prescriptions for certain controlled substances in excess of the 90-day limit, and filling prescriptions written by unlicensed medical professionals, the DEA said.
If you are or become a victim of a data breach, taking action within the first 48 hours can make a big difference in protecting your information, experts say. They recommend taking these seven actions right away.
Related Content
To continue reading this article
please register for free
This is different from signing in to your print subscription
Why am I seeing this? Find out more here
What Is a Debt-to-Equity Ratio and How Can Investors Use It?
Three Gen X Retirement Mistakes for Millennials, Gen Z to Avoid
