Pharmacy data breach exposes millions of customers’ data
By Greg Collier
When someone entrusts a billion-dollar company with their medical information, you might assume that they take security seriously. After all, HIPAA violations are no joke. The largest HIPAA fine so far was $18 million paid by a major health insurance company after they feel for a phishing attack, exposing client data in the process. So, say you’re the largest pharmacy chain in the nation. You’ve also tested countless customers for COVID-19. You must have some kind of impenetrable security in place to keep all that information private, right? Maybe not according to security experts.
A security consultant had his family tested for COVID-19 back in March at a local Walgreens. While getting his family’s test results, he discovered a flaw in Walgreens’ website that exposed customer information related to the COVID-19 tests. This information is said to have contained name, date of birth, phone number, address, and email along with other sensitive information. The consultant tried to get in touch with Walgreens to warn them about the flaw, but they allegedly ignored him. Tech news site, Recode, also investigated the flaw and notified Walgreens about it. Recode even gave Walgreens time to fix the vulnerability before they published their report, but according to Recode, the vulnerability still hasn’t been fixed.
As of the time of this post, there has been no confirmation that any bad actor has come into possession of any customer information. However, that doesn’t necessarily mean they haven’t. If you used Walgreens for COVID-19 testing since July 2020, you may want to keep an eye on your credit report. This breach could be a potential treasure trove for identity thieves. The information could also be used by scammers to sound more legitimate since they have some personal details of your life.
Leave a Reply