MedImpact data breach affects over 60,000 linked to Leggett & Platt

Manufacturing company Leggett & Platt reported a significant data security incident after its service provider, MedImpact, experienced a data breach.

 

Headquartered in Missouri, Leggett & Platt is an American diversified manufacturing company producing engineered components for homes, offices, and vehicles, including bedding, automotive, furniture, flooring, and specialised industrial products. MedImpact Healthcare Systems serves as the pharmacy benefits manager (PBM) administering prescription drug benefits for Leggett & Platt’s Employee Benefits Plan.

 

In a data security notice submitted to the office of California Attorney General, MedImpact said that on October 18 it detected an unauthorised intrusion into its network. The company promptly initiated an investigation, supported by external cyber security specialists, to assess the nature and extent of the breach.

 

It also took steps to secure the affected systems, contained the disruption and notified relevant law enforcement authorities about the incident.

 

The investigation determined that sensitive personal data of Leggett & Platt employees who received pharmacy benefits through MedImpact was compromised during the incident. The affected data included names and other personal identifiers.

 

The incident was reported to the U.S. Department of Health and Human Services where MedImpact said it has identified 61,702 individuals affected by the incident.

 

While MedImpact found no evidence of the compromised information being misused, it advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and the state attorney general.

 

 

The Qilin ransomware group claimed responsibility for the cyber attack on MedImpact, listing it as a victim of its cyber attack on the group’s data leak site. The group claimed to be in possession of confidential data stolen from the pharmacy benefits provider and threatened to release the data publicly if its ransom demands were not fulfilled.