Express Scripts Offers $1million Reward for Cyber Extortionists


This is an interesting story, I’ll be watching how it develops – it’s not often you see a bounty for online crimes and especially one as enticing as 1 million dollars!

That’s a hell of a sum for nailing down some dodgy hackers who are running an extortion scam after a data leak.

I really wonder where this will lead.

A US-based prescription processing and benefits firm has taken the unusual step of offering a $1m bounty for information that leads to the arrest and conviction of an unknown group which targeted it in a cyber-extortion scam.

Express Scripts went public last week with news that it received personal details on 75 end users including, in some cases, prescription data. Blackmailers threatened to expose millions of records they claimed were in their possession unless the firm paid up.

The cyber-extortionists responded to a refusal to pay up by moving onto the customers of Express Scripts with similar threats, sent in letters to these various organisations. Express Scripts responded on Tuesday by upping the ante and offering a $1m reward for information that put the unidentified miscreants behind bars

Also in situations like this you have to bear in mind the terms and conditions, the reward actually requires that legal action be taken against the criminals and not just their identity known.

Imagine if they are in a country that has no extradition laws or doesn’t have good relations with the US.

In a related move, Express Scripts offered identity restoration services to anyone who becomes a victim of identity theft as a result of its security breach. It has set up a website to provide information to its members – insurance carriers, employers, unions and the like who run health benefit plans – to provide support at esisupports.com. It has also has hired risk consulting firm Kroll to help its members.

The cause of the breach that led to the data leak and the extent of the compromise are still under investigation. Beyond saying it “deploys a variety of security systems designed to protect their members’ personal information from unauthorized access”, Express Scripts (which handles a reported 50 million prescriptions a year) has said little about the breach or how it intends to prevent a repetition.

As well as posting a reward, Express Scripts has called in the FBI in its attempts to bring the blackmailers threatening its business to book. Anyone with information on that threats is advised to contact the FBI on 800-CALL-FBI. ®

It’s interesting that the whole issue of how the data integrity was comprised and what happened exactly to expose the customer details.

Perhaps the whole thing is a PR management exercise to divert attention away from the real issues, they may have issued the reward in safe knowledge the people involved will never be served justice.

But then that’s just me being a skeptic.

Source: The Register

Posted in: Hacking News, Legal Issues, Privacy

, , ,


Latest Posts:


truffleHog - Search Git for High Entropy Strings with Commit History truffleHog – Search Git for High Entropy Strings with Commit History
truffleHog is a Python-based tool to search Git for high entropy strings, digging deep into commit history and branches. This is effective at finding secrets accidentally committed.
AIEngine - AI-driven Network Intrusion Detection System AIEngine – AI-driven Network Intrusion Detection System
AIEngine is a next-generation interactive/programmable Python/Ruby/Java/Lua and Go AI-driven Network Intrusion Detection System engine with many capabilities.
Sooty - SOC Analyst All-In-One CLI Tool Sooty – SOC Analyst All-In-One CLI Tool
Sooty is a tool developed with the task of aiding a SOC analyst to automate parts of their workflow and speed up their process.
UBoat - Proof Of Concept PoC HTTP Botnet Project UBoat – Proof Of Concept PoC HTTP Botnet Project
UBoat is a PoC HTTP Botnet designed to replicate a full weaponised commercial botnet like the famous large scale infectors Festi, Grum, Zeus and SpyEye.
LambdaGuard - AWS Lambda Serverless Security Scanner LambdaGuard – AWS Lambda Serverless Security Scanner
LambdaGuard is a tool which allows you to visualise and audit the security of your serverless assets, an open-source AWS Lambda Serverless Security Scanner.
exe2powershell - Convert EXE to BAT Files exe2powershell – Convert EXE to BAT Files
exe2powershell is used to convert EXE to BAT files, the previously well known tool for this was exe2bat, this is a version for modern Windows.


One Response to Express Scripts Offers $1million Reward for Cyber Extortionists

  1. J November 14, 2008 at 1:22 pm #

    The reward is to quantify damages for the prosecuting attorneys. They can say it cost us 1 million dollars in damages, it eliminates the defense attorneys argument of … what is the real loss? How do you put a real value on reputation etc.? That is why Microsoft does it.