Rite Aid
Disclosed Jul 15, 20242 years ago2,200,000 affectedConfirmed
Impersonation attack exposes Rite Aid customer ID data from 2017 to 2018 purchases
Rite Aid said an unknown party impersonated an employee on June 6, 2024 to compromise business credentials and access systems. The attacker acquired names, addresses, dates of birth and driver's license or ID numbers tied to certain retail purchases made between June 2017 and July 2018; no Social Security, financial or patient data was involved.
What is known
| People affected | 2,200,000 (as reported by the organization) |
|---|---|
| Disclosed | Jul 15, 2024 |
| Discovered | Jun 6, 2024 |
| Happened | Jun 6, 2024 |
| Attack | Phishing |
| Data exposed | Names, Addresses, Dates of birth, Government IDs |
| Sector | Retail · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Rite Aidoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Rite Aidatg.wa.gov · Official notice | Official notice |
| Notice letter filed with the Delaware DOJ: Rite Aidattorneygeneral.delaware.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Rite Aidjustice.oregon.gov · Official notice | Official notice |
| California AG breach notice: Rite Aid Corporationoag.ca.gov · Regulator | Regulator |
| Vermont Attorney General: 2024-07-15 Rite Aid Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| Indiana Attorney General 2024 data breach report: Rite Aidin.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | Jul 15, 2024 | |
| Washington AGresidents of WA | Jul 15, 2024 | 96,270 |
| Delaware DOJresidents of DE | Jul 15, 2024 | 17,787 |
| Oregon DOJresidents of OR | Jul 15, 2024 | 2,200,000 |
| Researchtotal | Jul 15, 2024 | |
| Vermont AGresidents of VT | Jul 15, 2024 | |
| Indiana AGresidents of IN | Jul 15, 2024 | 6,923 |
Other breaches at Rite Aid
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Disclosed Jul 19, 2023Jul 19, 20233 years agoHacking | Jul 19, 20233 years ago | Hacking | Healthcare | Confirmed | 23K |
| Disclosed Jul 29, 2020Jul 29, 20206 years agoLost or stolen device | Jul 29, 20206 years ago | Lost or stolen device | Healthcare | Confirmed | 14K |
| Disclosed Oct 1, 2018Oct 1, 20187 years ago | Oct 1, 20187 years ago | Not stated | Other | Confirmed | Unknown |
| Disclosed May 17, 2017May 17, 20179 years ago | May 17, 20179 years ago | Not stated | Healthcare | Confirmed | 19K |
| Disclosed Jun 3, 2015Jun 3, 201511 years agoHacking | Jun 3, 201511 years ago | Hacking | Healthcare | Confirmed | 2,345 |
| Disclosed Dec 7, 2011Dec 7, 201114 years ago | Dec 7, 201114 years ago | Not stated | Healthcare | Confirmed | 2,900 |
History of this record
- 2026-09-25 · source: empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Reportdec-2024.pdf · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2024-07-15-rite-aid-data-breach-notice-consumers · backfill source
- 2026-09-25 · sector: health to retail · seed source
- 2026-09-25 · data_types: ["names"] to ["names","addresses","dob","government-id"] · seed source
- 2026-09-25 · summary: empty to Rite Aid said an unknown party impersonated an employee on June 6, 2024 to compromise business credentials and access systems. The attacker acquired names, addresses, dates of birth and driver's license or ID numbers tied to certain retail · seed source
- 2026-09-25 · title: empty to Impersonation attack exposes Rite Aid customer ID data from 2017 to 2018 purchases · seed source
- 2026-09-25 · data_types: [] to ["names"] · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 2200000 · backfill source
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to phishing · backfill source
- 2026-09-25 · discovered: empty to 2024-06-06 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.