Rite Aid

Disclosed Jun 3, 20152,345 affectedConfirmed

On April 27, 2015, rioters in Baltimore, MD broke into, vandalized, and looted eight locations of the covered entity (CE), Rite Aid, taking 2,345 filled prescriptions. The “will-call” prescriptions involved in the breach contained patients’ names, addresses, and medication names. The CE provided breach notification to HHS, the media, and affected individuals and offered credit monitoring. All of the vandalized locations, except the one that was burned, have been re-opened with full security restored. OCR obtained assurances that the CE implemented the corrective actions listed.

What is known

People affected	2,345 (as reported to HHS)
Disclosed	Jun 3, 2015
Happened	Aug 20, 2014
Attack	Hacking
Data exposed	NamesPayment cardsEmailsPhone numbersAddressesHealth
Sector	Healthcare · US
Status	Confirmed

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: Rite Aid

Official noticeatg.wa.gov

Washington Attorney General breach notice: Rite Aid

Official noticein.gov

Indiana Attorney General 2016 data breach report: Rite Aid

Official noticein.gov

Indiana Attorney General 2015 data breach report: Rite Aid

Official noticemaine.gov

Maine Attorney General breach notice archive: Rite Aid

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): Rite Aid (Healthcare Provider, PA)

Notices filed

TotalJun 3, 2015

HHS archive2,345 people

Residents of CASep 22, 2015

California AGCount not stated

Residents of INSep 22, 2015

Indiana AG149 people

Residents of MESep 22, 2015

Maine AG1,674 people

Residents of WASep 29, 2015

Washington AG2,721 people

Residents of INFeb 3, 2016

Indiana AG1 person

Other breaches at Rite Aid

Impersonation attack exposes Rite Aid customer ID data from 2017 to 2018 purchasesPhishing exposed names, addresses, dates of birth and government IDs. Reported to the California AG.Phishing2.2M affectedRetailUSJul 15, 2024 Hacking breachHacking exposed names and health records. Reported to the California AG.23K affectedHealthcareUSJul 19, 2023 Lost or stolen device breachLost or stolen device exposed names and health records. Reported to the HHS archive.14K affectedHealthcareUSJul 29, 2020 Breach, details not statedBreach notice filed with the California AG, details not stated.USOct 1, 2018 Breach, details not statedBreach notice filed with the Indiana AG, details not stated.19K affectedHealthcareUSMay 17, 2017 Breach, details not statedExposed names and health records. Reported to the HHS archive.2,900 affectedHealthcareUSDec 7, 2011

History of this record

data_types2026-09-25

["names","payment-card","emails","phone","addresses"] to ["names","payment-card","emails","phone","addresses","health"]by backfillSource

records_basis2026-09-25

empty to hhsby backfillSource

records2026-09-25

empty to 2345by backfillSource

disclosed2026-09-25

2015-09-22 to 2015-06-03by backfillSource

summary2026-09-25

empty to On April 27, 2015, rioters in Baltimore, MD broke into, vandalized, and looted eight locations of the covered entity (CE), Rite Aid, taking 2,345 filled prescriptions. The “will-call” prescriptions involved in the breach contained patients’by backfillSource

data_types2026-09-25

[] to ["names","payment-card","emails","phone","addresses"]by backfillSource

source2026-09-25

empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-date-Report-2015.pdfby backfillSource

source2026-09-25

empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-date-Report-2016.pdfby backfillSource

sector2026-09-25

other to healthby backfillSource

attack2026-09-25

unknown to hackingby backfillSource

occurred2026-09-25

empty to 2014-08-20by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Rite Aid