On April 27, 2015, rioters in Baltimore, MD broke into, vandalized, and looted eight locations of the covered entity (CE), Rite Aid, taking 2,345 filled prescriptions. The “will-call” prescriptions involved in the breach contained patients’ names, addresses, and medication names. The CE provided breach notification to HHS, the media, and affected individuals and offered credit monitoring. All of the vandalized locations, except the one that was burned, have been re-opened with full security restored. OCR obtained assurances that the CE implemented the corrective actions listed.
What is known
People affected
2,345 (as reported to HHS)
Disclosed
Jun 3, 2015
Happened
Aug 20, 2014
Attack
Hacking
Data exposed
Names, Payment cards, Emails, Phone numbers, Addresses, Health
2026-09-25 · data_types: ["names","payment-card","emails","phone","addresses"] to ["names","payment-card","emails","phone","addresses","health"] · backfill source
2026-09-25 · records_basis: empty to hhs · backfill source
2026-09-25 · records: empty to 2345 · backfill source
2026-09-25 · disclosed: 2015-09-22 to 2015-06-03 · backfill source
2026-09-25 · summary: empty to On April 27, 2015, rioters in Baltimore, MD broke into, vandalized, and looted eight locations of the covered entity (CE), Rite Aid, taking 2,345 filled prescriptions. The “will-call” prescriptions involved in the breach contained patients’ · backfill source
2026-09-25 · data_types: [] to ["names","payment-card","emails","phone","addresses"] · backfill source
2026-09-25 · source: empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-date-Report-2015.pdf · backfill source
2026-09-25 · source: empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-date-Report-2016.pdf · backfill source
2026-09-25 · sector: other to health · backfill source
2026-09-25 · attack: unknown to hacking · backfill source
2026-09-25 · occurred: empty to 2014-08-20 · backfill source
