Capsule capsule.com Capsule data breach: what happened and what to do
Capsule, an online pharmacy, reported a hack in April 2022 that affected about 27,625 people. Names, addresses, dates of birth, diagnoses and medications were involved.
View all 13,177 breaches- Breach date
- 5 Apr 2022
- Made public
- 27 May 2022
- Affected
- 27,625
- Data exposed
- Names, Physical addresses, Dates of birth, Diagnoses, Medications
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Capsule is a digital pharmacy that delivers prescriptions. In 2022 it reported to the U.S. Department of Health and Human Services (HHS) that it was the victim of a hacking incident affecting about 27,625 people. The California Attorney General's list also carries the notice, dated April 5, 2022, and it was posted in late May 2022. News coverage quoted the company saying the likely cause was password spraying, where attackers try common passwords against many accounts, and that an outside firm found no weakness in its own systems.
Sources checked: ocrportal.hhs.gov, oag.ca.gov, kffhealthnews.org
Last verified against the official page:
What was exposed
HHS lists names, addresses, dates of birth, diagnoses or conditions, and medications.
No Social Security numbers appear in that list. Even so, a date of birth plus a medication or condition is enough to make a phishing call or text sound like it comes from a pharmacy or insurer.
What Capsule did
Capsule notified HHS, the people affected and the media, and posted substitute notice. HHS says it offered complimentary credit monitoring and added technical safeguards.
Why it matters for you
A breach at a pharmacy is mostly a phishing risk. Scammers use real details, such as your name and a prescription, to sound legitimate. Treat any unexpected message about your medication or account as unverified until you confirm it through the company's own site or phone number.
What to do if you were in it
- 1
Use the credit monitoring if you were offered it
Your notice letter says how to sign up. The FTC recommends taking it.
- 2
Use a unique password and two-factor login
Password spraying works against reused and common passwords. Change your Capsule password and any account sharing it, and turn on two-factor login where available.
- 3
Be wary of pharmacy and insurer messages
Expect calls and texts that mention your medications. Don't click links or share details; contact the company on a number you look up yourself.
- 4
Check your insurance statements
Read your explanation of benefits and question anything you didn't receive.
- 5
Report misuse
If someone uses your identity, report it at IdentityTheft.gov. To see which other breaches include your email or phone, run a free Serus scan.
Official filings
- U.S. Department of Health and Human Services , filed 27 May 2022 : 27,625 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Capsule data breach?
Capsule says it notified the people involved. If you got a notice letter, you were affected.
What was exposed in the Capsule breach?
HHS lists names, addresses, dates of birth, diagnoses or conditions, and medications.
Should I change my Capsule password?
Yes. Use a unique password and turn on two-factor login, and change it anywhere you reused it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
