HackingRetail & ConsumerFinancial ServicesRetailStolen CredentialsPhishingSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountCredentialsMediumActive

CVS Pharmacy, Inc.

bd_0146674d7aa449bb · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 1, 2015

Filed

Sep 10, 2015

To disclose

10 weeks

Affected

2,493state residents only

Linked

4 filings

Confidence

65%

Full breach record for CVS Pharmacy, Inc. →9 incidents on file

CVS Pharmacy, Inc. notified the NH Attorney General of a breach at third-party vendor PNI Digital Media affecting CVSPhoto.com. Unauthorized access occurred between June 2014 and July 2015, exposing payment card data, names, and credentials. Approximately 2,493 NH residents were affected. CVS disabled the site, engaged forensic investigators, and provided 12 months of credit monitoring via Experian.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 395 days

discovery → filing · 10 weeks / 71 days

Jun 1, 2014

Begins

Jul 1, 2015

Discovered

Sep 10, 2015

Filed

vs. sector median

+3 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_8534ceb654eebac52015-09-11 · +1dVerified
California State AGbd_fc4af90e78d486c12015-09-11 · +1dCandidate
South Carolina State AGbd_c170bb3c6ed5a8cb2015-09-14 · +4dVerified

Name: CVS Pharmacy, Inc.
norm: cvs pharmacy
Domain: cvs.com

Name: CVS Pharmacy, Inc.
norm: cvs pharmacy
Domain: cvs.com
Industry: Retail & ConsumerllmFinancial Servicesllm

Discovered: Jul 1, 2015
Breach occurred: Jun 1, 2014 – Jul 1, 2015
Undetected for: 395 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 11, 2015
Affected individuals: 2,493state-resident count only
Data types: Identity (basic)Financial accountCredentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1041 Exfiltration Over C2 ChannelT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: supply_chain

During the incident: Promptly disabled the CVSPhoto.com website
Began working with PNI to investigate
Working with experienced forensic investigators
Arranged for Experian to provide 12 months of credit monitoring and resolution of identity theft services
Sending written notification to affected customers
Advised the three major U.S. credit reporting agencies about this incident
Changes made: Conducting a comprehensive review of the security practices for the vendor who will host the service going forward
Reviewing the security practices for the vendor host
Advising customers to change passwords on other websites
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(71 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

New Hampshire State AGSep 10 · first · this page

Massachusetts State AG+1d

California State AG+1d

South Carolina State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/cvs-pharmacy-20150910.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 10, 2015
Raw hash: b054d42168a007535bba876ce44b14ad7e1c04dc683aac7211bc43c39e43826e

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityCVS Pharmacy, Inc.

Victim entityCVS Pharmacy, Inc.

Incidentdiscovered Jul 1, 2015

Stated responsePromptly disabled the CVSPhoto.com website

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov