MedImpact PBM

MedImpact detected intrusion on October 18, 2025, then took nine months to finish investigating what Qilin claims was 160 gigabytes taken, part of it from Elixir Solutions, the PBM MedImpact acquired from RiteAid. Prescription and treatment data, subscriber numbers, and in limited cases Social Security numbers moved through a vendor pipeline no employer could see into. HIPAA sets a sixty day notification clock. MedImpact ran nine months past it before mailing a single letter.