US pharma company Amerita said cyber attack impacted about 220k patients

Kansas-based pharmaceutical products and clinical services provider Amerita, Inc. said it suffered a cyber attack that compromised the sensitive personal information of almost 220,000 individuals.

Based in Kansas City, Amerita, Inc. is a specialty infusion company owned by US healthcare retail giant PharMerica. Amerita offers complex pharmaceutical products and clinical services in Kansas City.

In a press release, the company said that on March 14, its parent company PharMerica identified “suspicious activity on their computer network.” Immediately after learning about the network intrusion, the company, along with external cybersecurity experts, began an internal investigation to understand the nature and scope of the security incident and secure its network.

“The investigation determined that an unknown third party accessed Amerita computer systems from March 12-13, 2023, and that certain personal information may have been obtained as a part of the incident. Amerita recently identified a data set involved in the incident that contained the personal information of some Amerita patients,” reads the press release.

The compromised information includes names, addresses, certain patient information including their medical history, diagnosis, medications and health insurance information. the company has, however, confirmed that Amerita patients’ Social Security numbers and driver’s license numbers weren’t compromised in the data breach.

In a filing with the Office of Maine Attorney General, PharMerica, the parent company of Amerita, said that at least 5,815,591 individuals were affected by the cyber security incident that occurred on March 14. The filing also noted that the compromised information included individuals’ names, addresses, dates of birth, Social Security numbers, medications and health insurance information.

In a filing with the U.S. Department of Health and Human Services Office for Civil Rights, Amerita said the incident impacted as many as 219,707 patients. Also, its press release contradicts the data breach notice filed with the Office of the Maine Attorney General in which it stated that “Amerita has no indication that the incident involved Amerita patients’ Social Security numbers or driver’s license numbers.”

The company has so far found no evidence of the compromised information being misused, however, the possibility of the same cant be ruled out. It has urged all its patients to remain vigilant and monitor their credit reports, account statements and benefit statements regularly. If individuals detect any suspicious activity, that should be reported to proper law enforcement authorities, including the police and their state attorney general.

PharMerica in its regulatory filing said all affected individuals will be given a year of complimentary triple bureau credit and identity monitoring services via Kroll.