Skip to content

Walgreen

Disclosed Dec 3, 20196 years ago80,176 affectedConfirmed

Official notice

The covered entity (CE), Walgreen Company, reported that it experienced multiple burglaries at several locations that resulted in the theft of paper records and hard drives that contained the protected health information (PHI) of 80,176 individuals. The PHI involved included names, addresses, dates of birth, drivers’ license numbers, medications, and other treatment information. The CE notified HHS, affected individuals, the media, and provided substitute notice. In response to the breach, the CE provided complimentary credit monitoring services and implemented additional administrative safeguards to better protect its PHI.

What is known

People affected80,176 (as reported to HHS)
DisclosedDec 3, 2019
HappenedMay 26, 2020
AttackLost or stolen device
Data exposedNames, Health
SectorHealthcare · US
StatusConfirmed

Sources

Source
California Attorney General breach notice: Walgreenoag.ca.gov · Official notice
Indiana Attorney General 2021 data breach report: Walgreenin.gov · Official notice
HHS OCR breach report (archive, resolved): Walgreen (Healthcare Provider, IL)ocrportal.hhs.gov · Official notice

Notices filed

WhereFiledPeople
HHS archivetotalDec 3, 20193,700
California AGresidents of CAFeb 28, 2020
HHS archivetotalFeb 28, 20206,681
California AGresidents of CAJul 24, 2020
HHS archivetotalJul 24, 202080,176
Indiana AGresidents of INFeb 12, 20212

Other breaches at Walgreen

BreachAffected
Disclosed Oct 1, 2024Oct 1, 20241 year agoLost or stolen device2,708
Disclosed Jan 8, 2021Jan 8, 20215 years agoLost or stolen device16K
Disclosed Dec 6, 2013Dec 6, 201312 years agoLost or stolen device160K
Disclosed Jul 30, 2012Jul 30, 201214 years agoLost or stolen device1,240
History of this record
  • 2026-09-25 · disclosed: 2020-02-28 to 2019-12-03 · backfill source
  • 2026-09-25 · sector: other to health · backfill source
  • 2026-09-25 · attack: unknown to lost-device · backfill source
  • 2026-09-25 · data_types: [] to ["names","health"] · backfill source
  • 2026-09-25 · records_basis: organization to hhs · backfill source
  • 2026-09-25 · records: 30 to 80176 · backfill source
  • 2026-09-25 · summary: empty to The covered entity (CE), Walgreen Company, reported that it experienced multiple burglaries at several locations that resulted in the theft of paper records and hard drives that contained the protected health information (PHI) of 80,176 ind · backfill source
  • 2026-09-25 · records_basis: empty to organization · backfill source
  • 2026-09-25 · records: empty to 30 · backfill source
  • 2026-09-25 · disclosed: 2020-07-24 to 2020-02-28 · backfill source
  • 2026-09-25 · added · backfill source

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Walgreen

New breaches by email

Wednesdays, only in weeks with newly disclosed breaches, the largest first.

Double opt-in. Unsubscribe any time.