Pharmerica.com & BrightSpring Health Services Listed by Moneymessage Ransomware Group

On April 8, 2023, the ransomware group MoneyMessage listed both PharMerica and its parent company BrightSpring Health Services on its leak site, claiming that internal files had been exfiltrated during a ransomware attack. The disclosure directly affects anyone who has received pharmacy services, long-term care, or home-health support through these providers, meaning millions of patients, their family members, and caregivers may now face heightened privacy risks.

Reported Details from the Listing

The MoneyMessage leak-site posting states that internal files were taken in a ransomware incident but does not quantify the number of affected records or list specific data types. The notification simply confirms that data was successfully exfiltrated from both organizations. Publicly available corporate information shows PharMerica operates more than 180 long-term care pharmacies across nearly every state, while BrightSpring provides home- and community-based health services focused on complex and chronic-care populations. The primary source does not disclose the exact volume of data or name the precise systems compromised.

Why This Matters for You and Your Family

When pharmacy and home-health providers are breached, the information exposed often includes names, dates of birth, Social Security numbers, medical histories, insurance details, and prescription records. Even though the listing does not specify what was taken, internal files from these organizations routinely contain exactly this kind of sensitive personal and health data. For ordinary families, that means your or your loved one’s medical privacy could be permanently compromised. A single leak can lead to insurance fraud, prescription abuse in your name, or denial of care based on leaked health conditions.

The Doxxing and Identity-Chain Risks

Health-care records are high-value fuel for doxxing because they link real identities to addresses, phone numbers, family relationships, and sometimes even treatment details that attackers can weaponize. Once criminals obtain these files, they frequently cross-reference them with other breaches to build complete identity profiles. Credential leaks that surface in the same ecosystem can cascade into account takeovers on patient portals, email, or even children’s gaming accounts that reuse the same passwords. The result is a chain of exposure that can follow your family for years.

MoneyMessage’s Known Track Record

Public reporting attributes MoneyMessage with emerging in late 2022 as a ransomware-as-a-service operation that combines encryption with data extortion. The group typically gains initial access through phishing or exploited remote desktop protocols, exfiltrates sensitive files before deploying ransomware, and then posts samples on its leak site when victims refuse to pay. Notable prior targets have included healthcare and pharmaceutical organizations, consistent with the current PharMerica and BrightSpring listing. The group’s playbook relies on pressure through public exposure rather than prolonged negotiation, often setting short deadlines for payment before releasing additional data batches.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real identity so you can see exactly what chains back to this claimed breach.
• Rotate any password you used at PharMerica, BrightSpring, or their patient portals anywhere it has been reused, and switch to 2FA through an authenticator app instead of SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours rather than months.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often become the weakest link in doxxing chains.
• Let DoxxScan’s remediation specialists handle takedown requests across data brokers and extortion sites on your behalf while you focus on securing your accounts.

The PharMerica and BrightSpring breach is a reminder that health-care data breaches continue at scale and that ordinary families bear the long-term consequences. Starting with a clear picture of your exposure is the most practical step you can take today. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with full household coverage that includes children’s gaming accounts vulnerable to credential-based attacks.