(Photo by Michael M. Santiago/Getty Images)
UPDATE 7/16: Rite Aid says the hack affected 2.2 million customers, far lower than the 45 million claimed by RansomHub.
Original Story:
Rite Aid has suffered a data breach that appears to involve a ransomware gang stealing customer information from the drugstore chain.
Rite Aid says the breach occurred on June 6, when a hacker impersonated a company employee and used their login credentials to access certain business systems. Although Rite Aid detected the intrusion within 12 hours, the hacker still stole data involving “certain data associated with the purchase or attempted purchase of specific retail products,” the company says.
“This data included purchaser name, address, date of birth and driver’s license number or other form of government-issued ID presented at the time of a purchase,” Rite Aid says.
Importantly, the hacker only stole data for purchases between June 6, 2017, and July 30, 2018.
As a result, some of the stolen data, such as driver’s license numbers, are likely outdated. Rite Aid also says no Social Security numbers, financial data, or patient information was stolen.
A ransom gang called RansomHub has claimed responsibility and says it has 10GB of data from the drugstore chain, including “45 million lines of people's personal information," such as name, dates of birth, addresses and "dl_id number."
(Credit: RansomHub)The gang says it was in contact with Rite Aid before the chain severed communication. It's now giving Rite Aid 10 days to pay or it’ll leak the stolen information. “From this it is obvious that the Riteaid leadership don't value the safety of it's customers sensitive details,” RansomHub says.
Rite Aid didn’t immediately respond to a request for comment on the claims from the RansomHub. In the meantime, the company plans on notifying affected consumers about the breach and has created a toll-free line at (866) 810-8094 to answer questions.
“We regret that this incident occurred and are implementing additional security measures to prevent potentially similar attacks in the future,” the drugstore chain says. “We also reported the incident to law enforcement, as well as federal and state regulators.”
RansomHub, which is likely based out of Russia, has been grabbing headlines in recent weeks for other attacks connected to UnitedHealth Group, the international auction house Christie's, and Frontier Communications.