Skip to content
Breaches.

Walgreen

Disclosed Dec 6, 201312 years ago160,000 affectedConfirmed

Official notice

Walgreens, the covered entity (CE), reported that one of its pharmacies located in Nashville, Tennessee, was burglarized and protected health information (PHI) was stolen. This breach affected 703 individuals and the PHI involved included names, addresses, dates of birth, phone numbers, Social Security numbers, medications prescribed, and health insurance information. The CE notified HHS, affected individuals, the media, local law enforcement, and provided substitute notice. The CE implemented administrative and physical safeguards to better protect its PHI and retrained its staff. The CE also provided complimentary credit monitoring services. OCR obtained assurances that the CE implemented the corrective actions noted.

What is known

People affected160,000 (as reported to HHS)
DisclosedDec 6, 2013
HappenedDec 20, 2017
AttackLost or stolen device
Data exposedNames, Payment cards, Health
SectorHealthcare · US
StatusConfirmed

Sources

Source
California Attorney General breach notice: Walgreenoag.ca.gov · Official notice
Maine Attorney General breach notice archive: Walgreenmaine.gov · Official notice
HHS OCR breach report (archive, resolved): Walgreen (Healthcare Provider, IL)ocrportal.hhs.gov · Official notice

Notices filed

WhereFiledPeople
HHS archivetotalDec 6, 201317,350
HHS archivetotalJun 6, 2014540
HHS archivetotalDec 15, 2014160,000
HHS archivetotalMay 1, 20151,138
HHS archivetotalAug 7, 20158,345
HHS archivetotalMar 4, 2016880
HHS archivetotalFeb 3, 20174,500
HHS archivetotalApr 6, 2018910
HHS archivetotalApr 27, 2018703
Maine AGresidents of MEJun 1, 2018
California AGresidents of CAJun 19, 2018

Other breaches at Walgreen

BreachAffected
Disclosed Oct 1, 2024Oct 1, 20241 year agoLost or stolen device2,708
Disclosed Jan 8, 2021Jan 8, 20215 years agoLost or stolen device16K
Disclosed Dec 3, 2019Dec 3, 20196 years agoLost or stolen device80K
Disclosed Jul 30, 2012Jul 30, 201214 years agoLost or stolen device1,240
History of this record
  • 2026-09-25 · disclosed: 2014-06-06 to 2013-12-06 · backfill source
  • 2026-09-25 · disclosed: 2014-12-15 to 2014-06-06 · backfill source
  • 2026-09-25 · records: 8345 to 160000 · backfill source
  • 2026-09-25 · disclosed: 2015-05-01 to 2014-12-15 · backfill source
  • 2026-09-25 · disclosed: 2015-08-07 to 2015-05-01 · backfill source
  • 2026-09-25 · records: 4500 to 8345 · backfill source
  • 2026-09-25 · disclosed: 2016-03-04 to 2015-08-07 · backfill source
  • 2026-09-25 · disclosed: 2017-02-03 to 2016-03-04 · backfill source
  • 2026-09-25 · records: 910 to 4500 · backfill source
  • 2026-09-25 · disclosed: 2018-04-06 to 2017-02-03 · backfill source
  • 2026-09-25 · records: 703 to 910 · backfill source
  • 2026-09-25 · disclosed: 2018-04-27 to 2018-04-06 · backfill source
  • 2026-09-25 · sector: other to health · backfill source
  • 2026-09-25 · attack: unknown to lost-device · backfill source
  • 2026-09-25 · data_types: ["names","payment-card"] to ["names","payment-card","health"] · backfill source
  • 2026-09-25 · records_basis: empty to hhs · backfill source
  • 2026-09-25 · records: empty to 703 · backfill source
  • 2026-09-25 · disclosed: 2018-06-01 to 2018-04-27 · backfill source
  • 2026-09-25 · summary: empty to Walgreens, the covered entity (CE), reported that one of its pharmacies located in Nashville, Tennessee, was burglarized and protected health information (PHI) was stolen. This breach affected 703 individuals and the PHI involved included n · backfill source
  • 2026-09-25 · data_types: [] to ["names","payment-card"] · backfill source
  • 2026-09-25 · disclosed: 2018-06-19 to 2018-06-01 · backfill source
  • 2026-09-25 · added · backfill source

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Walgreen

New breaches by email

Wednesdays, only in weeks with newly disclosed breaches, the largest first.

Double opt-in. Unsubscribe any time.