(Angus Mordant/Bloomberg via Getty Images)
Rite Aid says a recent data breach affects 2.2 million users — far fewer than the 45 million claimed by the ransomware group allegedly behind the attack.
The drugstore chain was previously mum on the number of users affected. But on Monday, Rite Aid disclosed the 2.2 million figure in a data breach notice to Maine’s attorney general.
Although Rite Aid has so far declined to identify those behind the attack, a ransomware group called RansomHub claims to have stolen 10GB of information from the company. The gang says it looted customer information, including names, addresses, dates of birth, and driver’s license numbers, which aligns with Rite Aid’s findings. However, RansomHub suggested in a post on its website that it stole data from 45 million Rite Aid customers.
(Credit: RansomHub)The ransomware gang is now demanding Rite Aid pay up to keep the data secret or else RansomHub will leak it in nine days. The group also claims the company was preparing to negotiate a payment before cutting off communications. “From this it is obvious that the Riteaid [sic] leadership don't value the safety of it's [sic] customers sensitive details,” the gang alleged.
Rite Aid didn’t comment on whether it plans to make a ransom payment, saying only that "Rite Aid experienced a limited cybersecurity incident in June, and we are finalizing our investigation. We take our obligation to safeguard personal information very seriously, and this incident has been a top priority. Together with our third-party cybersecurity partner experts, we have restored our systems and are fully operational.”
In addition, the company is notifying affected customers while offering them 12 months of free credit and identity theft monitoring. Rite Aid said it began investigating the breach within 12 hours of detecting the intrusion on June 6. But the company’s official data breach notice to Maine’s attorney general indicates it needed two weeks to fully uncover the hack.