MedImpact Hit by Cyberattack, Claims Processing Delayed

California-based pharmacy benefit manager MedImpact reported a data security incident that disrupted several key systems and temporarily halted pharmacy claims payments.

 

Headquartered in San Diego, California, is a pharmacy benefit manager (PBM) that administers prescription drug programs and serves as an intermediary between health plans, pharmacies, and drug manufacturers.

 

In a data security incident notice published on its website, MedImpact said that it recently identified a ransomware attack on its internal network, in which hackers deployed malware on its servers and encrypted critical systems. The company immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

 

While MedImpact has not yet disclosed details or the full scope of the incident, the company stated that it is working to restore the affected systems.

 

“MedImpact is currently working to restore impacted systems in a new environment that is segregated from the prior infrastructure and protected by multiple layers of defense. Due to these measures, as of today, pharmacy claims for all clients are now adjudicating,” MedImpact said.

 

 

 

The Qilin ransomware group claimed responsibility for a cyber attack on MedImpact, adding the company to its data leak site. The group said that it obtained 160GB of confidential information, which includes data from Elixir Solutions, a company that MedImpact acquired from RiteAid last year.

 

It remains unclear whether MedImpact paid a ransom, the amount demanded by Qilin, or the method the attackers used to breach the company’s network.