A threat actor has claimed to be selling a database belonging to Bausch Health, allegedly containing sensitive medical information, including 1.6 million medical DEA numbers and prescriber details. The threat actor asserts that this data is related to a larger breach involving over 3TB of data from Bausch Health Companies, potentially linked to a Snowflake security incident.
A DEA number, as explained by the threat actor, is a unique identifier assigned by the United States Drug Enforcement Administration to healthcare providers, allowing them to prescribe controlled substances. This breach is particularly concerning as it could enable the unauthorized writing of prescriptions for drugs like Adderall, oxycodone, oxycontin, xanax, methadone, and others.
The threat actor has set an “Exclusive Price” of $3 million USD for Bausch Health to buy back the data and prevent its sale. They note that DEA numbers are not easily reset, requiring a cumbersome process that could leave doctors unaware of their compromised status.
For online sales, the data is being offered in packages, with pricing as follows:
$10,000 for 10 DEA numbers
$25,000 for 50 DEA numbers
$50,000 for 100 DEA numbers
The threat actor insists that the sale will occur only in packages and requires a middleman to facilitate the transaction. They emphasize that there will be no individual sales of DEA numbers.
