VectraRx Mail Pharmacy Data Breach 2025: 109,383 Affected. Names, SSNs, Prescriptions Exposed. Seven Class Actions Filed in D. Ariz. What To Do

VectraRx Mail Pharmacy Services, LLC is a mail-order pharmacy headquartered in Oro Valley, Arizona that dispenses prescriptions for workers’ compensation and personal-injury claims, coordinating directly with treating physicians and insurance carriers. On December 13, 2024, VectraRx detected unusual activity on one of its servers and engaged a third-party cybersecurity firm to investigate. The forensic review concluded on January 7, 2025 that an unauthorized actor had accessed files containing protected health information for 109,383 individuals across the United States. VectraRx mailed individual notification letters and filed the breach with the U.S. Department of Health and Human Services Office for Civil Rights on February 6, 2025, classified as a Hacking/IT Incident at a Network Server. Within days, seven proposed federal class actions were filed in the U.S. District Court for the District of Arizona.

Timeline

• December 13, 2024. VectraRx detected unusual activity on one of its servers and engaged a third-party cybersecurity firm.
• January 7, 2025. Forensic review of the impacted data completed; 109,383 individuals identified.
• February 6, 2025. Individual notification letters mailed; breach reported to HHS OCR (Hacking/IT Incident, Network Server).
• February 2025. Seven proposed class actions filed in the U.S. District Court for the District of Arizona (case numbers 4:25-cv-00058, 4:25-cv-00068, 4:25-cv-00071, 4:25-cv-00076, 4:25-cv-00077, 4:25-cv-00078, and 4:25-cv-00080).

What was exposed

According to VectraRx’s notification letters and reporting in HIPAA Journal and the plaintiff-firm investigations, the compromised data files contained:

• Full name
• Date of birth
• Social Security number
• Prescription (Rx) number
• Prescription information, the medication name and details associated with the Rx
• Date of service

Because VectraRx’s patient base is workers’ compensation and personal-injury claimants, the prescription information in the dataset is tied directly to on-the-job injuries and accident-related medical conditions. A leaked Rx record from a workers’ comp mail pharmacy can effectively disclose that the patient was injured, what they were treated for, and which medications they are taking. That is a more sensitive category of prescription data than a typical retail pharmacy record.

VectraRx has not publicly disclosed how long the attacker maintained access prior to detection, or how the intrusion occurred.

What VectraRx is offering

Affected individuals are being offered 12 to 24 months of complimentary credit monitoring and identity theft restoration services through Identity Defense. Enrollment instructions and an activation code are included in each individual notification letter.

VectraRx has also published a dedicated breach response line:

• Support line: 1-833-799-4210 (Monday to Friday, 8 a.m. to 8 p.m. Eastern)

Class-action posture

Seven proposed federal class actions were filed in the U.S. District Court for the District of Arizona under case numbers 4:25-cv-00058, 4:25-cv-00068, 4:25-cv-00071, 4:25-cv-00076, 4:25-cv-00077, 4:25-cv-00078, and 4:25-cv-00080. The complaints allege that VectraRx negligently failed to safeguard the personal and protected health information of its mail-order pharmacy customers, and seek damages and injunctive relief on behalf of the proposed nationwide class.

In addition to the firms of record on the filed cases, the following plaintiffs’ firms publicly announced investigations into the breach: Murphy Law Firm, Strauss Borrelli PLLC, Federman & Sherwood, Levi & Korsinsky LLP, Migliaccio & Rathod LLP, Potter Handy LLP, and Console & Associates, P.C. We are not a law firm and do not give legal advice.

What to do

This week:

1. Enroll in the Identity Defense credit monitoring offered in your notification letter before the enrollment deadline. The activation code is in the letter.
2. Place a free credit freeze at Equifax, Experian, and TransUnion. With SSN and date of birth exposed, the freeze is the highest-leverage protection against new-account fraud.
3. File IRS Form 14039 to flag your SSN against fraudulent tax-return filings.

This month:

4. Watch for unusual prescription or pharmacy-benefit activity under your name. Because Rx number, Rx information, and date of service are in the dataset, prescription-fraud rings can attempt refills or reroute deliveries using the leaked identifiers.
5. Stop the ongoing sharing of your prescription and pharmacy data. Independent of the VectraRx incident itself, HealthConsent files HIPAA restriction requests, FTC Health Breach Notification Rule deletion requests, and state-law deletion requests so prescription and health data is not continuously re-shared by data brokers and prescription-network resellers.
6. Keep the notification letter. It is the proof-of-exposure document you will need if you choose to join one of the pending class actions or pursue identity-theft restitution.

Sources

• HIPAA Journal: VectraRx Mail Pharmacy Services Notifies 109K Individuals About Data Breach
• Bloomberg Law: Online Pharmacy VectraRx Hit With Seven Suits Over Data Breach
• JD Supra / Console & Associates: VectraRx Mail Pharmacy Confirms 2024 Data Breach Leaked Sensitive Information Belonging to 109,383 People
• ClaimDepot: VectraRx Data Breach Exposes PHI & PII of 109,383 Americans
• Strauss Borrelli PLLC: VectraRx Mail Pharmacy Services Data Breach Investigation
• Murphy Law Firm / GlobeNewswire: VectraRx Data Breach Exposes Personal Information
• HHS Office for Civil Rights Breach Portal