PharMerica

Disclosed May 12, 20235,815,591 affectedConfirmed

Hackers access personal and medication data of 5.8 million PharMerica patients

Pharmacy services provider PharMerica learned of suspicious network activity on March 14, 2023 and found that an unknown party had accessed its systems on March 12 and 13. Names, addresses, dates of birth, Social Security numbers, medications and insurance details of about 5.8 million current and deceased individuals were exposed.

What is known

People affected	5,815,591 (as reported to HHS)
Disclosed	May 12, 2023
Discovered	Mar 21, 2023
Happened	Mar 12, 2023
Attack	Hacking
Data exposed	NamesAddressesDates of birthSocial Security numbersHealthInsurance
Sector	Healthcare · US
Status	Confirmed

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: PharMerica

Official noticeattorneygeneral.delaware.gov

Notice letter filed with the Delaware DOJ: PharMerica

Official noticejustice.oregon.gov

Oregon DOJ breach notice: PharMerica

Regulatoroag.ca.gov

California AG data breach notice: PharMerica Corporation

Newstechcrunch.com

US pharmacy giant says hackers accessed personal data of almost 6 million patients

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): PharMerica (Healthcare Provider, KY)

Notices filed

Residents of ORMay 12, 2023

Oregon DOJ5,815,591 people

TotalMay 12, 2023

HHS archive5,815,591 people

TotalMay 16, 2023

Research5,800,000 people

Residents of DEJun 8, 2023

Delaware DOJ19,393 people

Residents of DEJun 8, 2023

Delaware DOJ19,393 people

Residents of CAJun 19, 2023

California AGCount not stated

Other breaches at PharMerica

Breach, details not statedExposed names, Social Security numbers, health records, insurance details and financial details. Reported to the Maine AG.HealthcareUSJan 12, 2018

History of this record

records_basis2026-09-25

organization to hhsby backfillSource

records2026-09-25

5800000 to 5815591by backfillSource

sector2026-09-25

other to healthby seedSource

attack2026-09-25

unknown to hackingby seedSource

data_types2026-09-25

["names"] to ["names","addresses","dob","ssn","health","insurance"]by seedSource

records_basis2026-09-25

empty to organizationby seedSource

records2026-09-25

empty to 5800000by seedSource

summary2026-09-25

empty to Pharmacy services provider PharMerica learned of suspicious network activity on March 14, 2023 and found that an unknown party had accessed its systems on March 12 and 13. Names, addresses, dates of birth, Social Security numbers, medicatioby seedSource

title2026-09-25

empty to Hackers access personal and medication data of 5.8 million PharMerica patientsby seedSource

disclosed2026-09-25

2023-06-08 to 2023-05-12by backfillSource

data_types2026-09-25

[] to ["names"]by backfillSource

disclosed2026-09-25

2023-06-19 to 2023-06-08by backfillSource

discovered2026-09-25

empty to 2023-03-21by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about PharMerica