Millions of Rite Aid customers’ names, IDs exposed

Attackers impersonated an employee of Rite Aid, a top US drugstore chain, to access the personal data of over two million of its customers.

Rite Aid Corporation has started contacting millions of potential victims whose data was exposed in a recent data breach. According to the company’s breach notification letter, attackers compromised Rite Aid employees' credentials in early June 2024 and accessed “certain business systems.”

While admins supposedly caught the incident within 12 hours of the company’s systems being infiltrated, the attackers managed to steal “data associated with the purchase or attempted purchase of specific retail products.”

Rite Aid’s submission to the Maine Attorney General indicates that the data breach impacted 2.2 million individuals. According to the company, attackers got hold of customer data such as:

• Names
• Addresses
• Dates of birth
• Driver’s license number or other government ID used for purchase

Rite Aid’s breach notification says that IDs “presented at the time of a purchase between June 6th, 2017, and July 30th, 2018” were exposed. The company emphasized that malicious actors failed to steal Social Security numbers, financial customer information, or patient information.

“We regret that this incident occurred and have reported it to law enforcement, as well as federal and state regulators. We are also implementing additional security measures to prevent potentially similar attacks in the future,” reads Rite Aid’s breach notification letter.

Last week the RansomHub ransomware cartel posted the company on its dark web blog used to showcase its latest victims. Attackers said they have stolen 10GB of sensitive data from the retail giant’s networks. After the incident wen public, the company told Cybernews it had suffered a “limited cybersecurity incident in June” and is now in the process of “finalizing our investigation.”

The Philadelphia-headquartered Rite Aid is one of America’s largest drug stores with over 2,300 locations spread throughout the US. The company reported revenues exceeding $24 billion in 2023. The drugstore chain employs 51,000 and claims to serve 1.6 million Americans every day.