Every public data breach

Disclosed this week44On record26,355

44 disclosed this week · 26,355 on record

CVS Pharmacy

Disclosed Sep 10, 20216,221 affectedConfirmed

Official notice

The covered entity (CE), CVS Pharmacy, reported that it experienced a cyber-attack that compromised the protected health information (PHI) of 6,221 individuals. The PHI involved included names, addresses, dates of birth, medications, and other treatment information. The CE notified HHS, affected individuals, and the media. In response to the breach, the CE implemented additional administrative and technical safeguards to better protect its PHI.

What is known

People affected6,221 (as reported to HHS)
DisclosedSep 10, 2021
HappenedJan 6, 2022
AttackHacking
Data exposedNamesHealth
SectorHealthcare · US
StatusConfirmed

Sources

Official noticeoag.ca.gov
California Attorney General breach notice: CVS Pharmacy
Official noticeocrportal.hhs.gov
HHS OCR breach report (archive, resolved): CVS Pharmacy (Healthcare Provider, RI)

Notices filed

TotalSep 10, 2021
HHS archive826 people
Residents of CAFeb 11, 2022
California AGCount not stated
TotalFeb 11, 2022
HHS archive6,221 people

Other breaches at CVS Pharmacy

Insider breachInsider exposed names and health records. Reported to the HHS archive.1,896 affectedHealthcareUSFeb 16, 2024Lost or stolen device breachLost or stolen device exposed names and health records. Reported to the HHS archive.26K affectedHealthcareUSJul 24, 2020Lost or stolen device breachLost or stolen device exposed names and health records. Reported to the HHS archive.5,645 affectedHealthcareUSJan 30, 2019Lost or stolen device breachLost or stolen device exposed names and health records. Reported to the HHS archive.836 affectedHealthcareUSOct 13, 2017Breach, details not statedBreach notice filed with the California AG, details not stated.323K affectedHealthcareUSSep 11, 2015
History of this record
disclosed2026-09-25
2022-02-11 to 2021-09-10by backfillSource
attack2026-09-25
unknown to hackingby backfillSource
data_types2026-09-25
[] to ["names","health"]by backfillSource
records_basis2026-09-25
empty to hhsby backfillSource
records2026-09-25
empty to 6221by backfillSource
summary2026-09-25
empty to The covered entity (CE), CVS Pharmacy, reported that it experienced a cyber-attack that compromised the protected health information (PHI) of 6,221 individuals. The PHI involved included names, addresses, dates of birth, medications, and otby backfillSource
Added2026-09-25
First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about CVS Pharmacy