 |
| Rite Aid Data Breach Exposes Personal Information of Over 2.2 Million Customers Amid Financial Turmoil and Legal Battles Image credit: Wikipedia |
Rite Aid, the third largest US drugstore chain, revealed that a data breach has compromised the personal information of over 2.2 million customers, including driver's license numbers, addresses, and dates of birth. This data, associated with purchases or attempted purchases of retail products made between June 6, 2017, and July 30, 2018, did not include social security numbers, financial information, or patient information.
The breach occurred on June 6, 2024, when an unknown third party impersonated a company employee to gain access to certain business systems. Rite Aid detected the incident within 12 hours, launched an internal investigation, and worked to terminate unauthorized access and remediate affected systems. The company disclosed the breach in mandatory filings with attorneys general in states like Maine, Massachusetts, Vermont, and Oregon.
RansomHub, a ransomware group, claimed responsibility for the attack, stating that it obtained more than 10GB of customer data. This group, which rebranded from Knight earlier this year, became the most prevalent ransomware group following a law enforcement operation in May that dismantled the infrastructure of rival group Lockbit. RansomHub mentioned on its dark web site that negotiations with Rite Aid officials were abruptly cut off by the company. Rite Aid did not comment on whether the compromised employee account was protected by multifactor authentication.
Rite Aid operates over 1,700 stores across 16 states and reported $5.7 billion in sales for its most recent fiscal quarter ending on June 3. The company filed for bankruptcy in October, seeking protection from lawsuits related to the opioid crisis. Additionally, Rite Aid is facing several lawsuits from a separate data breach in May 2023, which exposed patient names, dates of birth, addresses, prescription data, and insurance data for over 24,000 customers. The chain has previously reported data breaches in 2015, 2017, and 2018.
0 Comments