Rite Aid reports data breach and ransomware attack, a year after the previous data breach
Learn More
Rite Aid, one of the largest drugstore chains in the United States, has reported a data breach resulting from a cyberattack in June 2024, which was claimed by the RansomHub ransomware gang. This attack affected some of the company's systems.
Rite Aid has stated that they, along with third-party cybersecurity experts, have restored all compromised systems and are fully operational.
The RansomHub gang claimed to have obtained over 10 GB of customer information, equating to around 45 million lines of personal data. The group added Rite Aid to their dark web leak site after the company ceased ransom negotiations and threatened to leak the stolen data by July 24.
The compromised data includes:
- Names
- Addresses
- Driver’s license numbers
- Dates of birth
- Rite Aid rewards numbers
The number of affected individuals is not disclosed.
Update - as of 14th of July 2024, Rite Aid confirmed that certain of their systems were hit by a "limited cybersecurity incident".
As of 16th of July 2024, Rite Aid, states that 2.2 million customers' personal information was stolen. "This data included purchaser name, address, date of birth and driver’s license number or other form of government-issued ID presented at the time of a purchase between June 6, 2017, and July 30, 2018."
Rite Aid has a history of data breaches, including a significant incident in May 2023 that exposed sensitive patient information of more than 24,000 individuals. The company has also filed breach notifications with California regulators in 2015, 2017, and 2018.
