Breachesby GlyphRite Aid
Disclosed Jul 15, 20242,200,000 affectedConfirmed
Impersonation attack exposes Rite Aid customer ID data from 2017 to 2018 purchases
Rite Aid said an unknown party impersonated an employee on June 6, 2024 to compromise business credentials and access systems. The attacker acquired names, addresses, dates of birth and driver's license or ID numbers tied to certain retail purchases made between June 2017 and July 2018; no Social Security, financial or patient data was involved.
What is known
| People affected | 2,200,000 (as reported by the organization) |
|---|---|
| Disclosed | Jul 15, 2024 |
| Discovered | Jun 6, 2024 |
| Happened | Jun 6, 2024 |
| Attack | Phishing |
| Data exposed | NamesAddressesDates of birthGovernment IDs |
| Sector | Retail · US |
| Status | Confirmed |
Sources
California Attorney General breach notice: Rite AidWashington Attorney General breach notice: Rite AidNotice letter filed with the Delaware DOJ: Rite AidOregon DOJ breach notice: Rite AidCalifornia AG breach notice: Rite Aid CorporationVermont Attorney General: 2024-07-15 Rite Aid Data Breach Notice to ConsumersIndiana Attorney General 2024 data breach report: Rite Aid
Notices filed
Other breaches at Rite Aid
Hacking breachHacking exposed names and health records. Reported to the California AG.23K affectedHealthcareUSJul 19, 2023Lost or stolen device breachLost or stolen device exposed names and health records. Reported to the HHS archive.14K affectedHealthcareUSJul 29, 2020Breach, details not statedBreach notice filed with the California AG, details not stated.USOct 1, 2018Breach, details not statedBreach notice filed with the Indiana AG, details not stated.19K affectedHealthcareUSMay 17, 2017Hacking breachHacking exposed names, payment cards, emails, phone numbers, addresses and health records. Reported to the California AG.2,345 affectedHealthcareUSJun 3, 2015Breach, details not statedExposed names and health records. Reported to the HHS archive.2,900 affectedHealthcareUSDec 7, 2011
History of this record
empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Reportdec-2024.pdfby backfillSource
empty to https://ago.vermont.gov/document/2024-07-15-rite-aid-data-breach-notice-consumersby backfillSource
health to retailby seedSource
["names"] to ["names","addresses","dob","government-id"]by seedSource
empty to Rite Aid said an unknown party impersonated an employee on June 6, 2024 to compromise business credentials and access systems. The attacker acquired names, addresses, dates of birth and driver's license or ID numbers tied to certain retail by seedSource
empty to Impersonation attack exposes Rite Aid customer ID data from 2017 to 2018 purchasesby seedSource
[] to ["names"]by backfillSource
empty to organizationby backfillSource
empty to 2200000by backfillSource
other to healthby backfillSource
unknown to phishingby backfillSource
empty to 2024-06-06by backfillSource
First recordedby backfillSource
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.