Rite Aid on Monday confirmed that last month it experienced a security breach wherein customer data was acquired.
On June 6 an unknown third party impersonated a company employee and gained access to its internal systems, according to a company press release. The drugstore retailer detected the incident within 12 hours, launched an investigation and determined that the outside party acquired data regarding the purchase or attempted purchase of specific products. Data accessed included customer names, addresses, date of birth and driver’s license or other form of government-issued ID presented between June 6, 2017 and July 30, 2018.
Social security numbers, financial information and patient information was not impacted, per the company. Rite Aid did not answer Retail Dive's questions regarding the number of people impacted. However, the company said that it is finalizing its investigation. “We take our obligation to safeguard personal information very seriously, and this incident has been a top priority. Together with our third-party cybersecurity partner experts, we have restored our systems and are fully operational,” a company spokesperson said in an emailed statement.
Rite Aid reported the breach to law enforcement and federal and state regulators. The drugstore company is mailing letters to customers that were affected and has set up a phone line to answer questions.
“We regret that this incident occurred and are implementing additional security measures to prevent potentially similar attacks in the future,” the company said in a statement.
The drugstore retailer filed for Chapter 11 bankruptcy this past fall and named a new CEO. Since that time the company has been selling and closing a portion of its stores.
At the end of last year, Rite Aid was banned from using facial recognition technology for survelliance for five years. The Federal Trade Commission said the AI-based technology collected and stored images of people without their knowledge and generated thousands of false positives. At the time of the ruling, Rite Aid said in a statement that it disagreed with some of the FTC’s alligations.
