Rite Aid riteaid.com Rite Aid data breach: what happened and what to do
Rite Aid reported that on 6 June 2024 an attacker used a stolen employee login to reach its systems. Customers who made certain purchases between 2017 and 2018 had names, addresses, dates of birth and ID numbers exposed.
View all 13,115 breaches- Breach date
- 6 Jun 2024
- Made public
- 15 Jul 2024
- Data exposed
- Names, Physical addresses, Dates of birth, Government issued IDs
- Last updated
What happened
On 6 June 2024, according to Rite Aid's notice, an unknown party impersonated a company employee, compromised their business credentials and got into certain company systems. The company says it found the incident within 12 hours. Rite Aid told Maine's regulator that at least 2.2 million people were affected, per Malwarebytes.
The ransomware group RansomHub claimed the attack. Rite Aid hasn't named the attacker, and the group's own claims aren't verified.
What was exposed
The affected data covers purchases or attempted purchases of certain retail products between 6 June 2017 and 30 July 2018. It includes names, addresses, dates of birth and driver's license or other government ID numbers. Rite Aid says it didn't include Social Security numbers, financial information or patient information.
A driver's license number plus name and date of birth is enough for fake ID attempts and account takeover at companies that verify identity that way.
The company's response
Rite Aid mailed letters, ran an assistance line and offered 12 months of credit monitoring through Kroll.
What it means for you
Watch for phishing that mentions Rite Aid, and consider a credit freeze if your ID number was in the letter.
What to do if you were in it
- 1
Freeze your credit
Place a free credit freeze at Equifax, Experian and TransUnion. It blocks most new accounts opened in your name, and you can lift it whenever you apply for credit yourself.
- 2
Watch for ID misuse
If a driver's license number was exposed, watch for accounts or applications you didn't make. Ask your state's motor vehicle agency what it offers if your number is misused.
- 3
Expect phishing that mentions the breach
Emails, texts and calls may quote real details about you. Don't click links or give out information; go to the company's site yourself.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak.
Frequently asked
Was I affected by the Rite Aid data breach?
Affected people were mailed a letter. The data relates to certain purchases between June 2017 and July 2018.
Were Social Security numbers exposed?
Rite Aid says no Social Security numbers, financial information or patient information was involved.
Is there free credit monitoring?
Rite Aid offered 12 months of credit monitoring through Kroll. Check your letter for the enrollment details.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
