NEW YORKMisuseHealthcareRetail & ConsumerHealthcarePrivilege AbuseData MishandlingCustomer Data InvolvedData ExfiltratedHealth (basic)Identity (basic)Financial credentialsLowResolved

Rite Aid Corporation

bd_0466f8196c933572 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 18, 2015

Filed

Feb 3, 2016

To disclose

11 weeks

Affected

976

Linked

2 filings

Confidence

95%

Full breach record for Rite Aid Corporation →10 incidents on file

Rite Aid Pharmacy Store 01617 (NY) reported to HHS on 2016-02-03 an Unauthorized Access/Disclosure affecting 976 individuals. From November 19, 2014 through November 18, 2015, an internal employee obtained customers' credit card information and other personal identifiers from Desktop Computer and other systems, using them to commit credit card fraud. ePHI involved included names, addresses, dates of birth, and credit card data. The employee was terminated; card handling policies were revised; OCR provided technical assistance on HIPAA Security Rule compliance. Breached info located on Desktop Computer, Other.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS notified11 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 364 days

discovery → filing · 11 weeks / 77 days

Nov 19, 2014

Begins

Nov 18, 2015

Discovered

Feb 3, 2016

Filed

vs. sector median

on median

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_98776dfa47a3fd872016-02-09 · +6dVerified

Name: Rite Aid Corporation
norm: rite aid
Domain: riteaid.com
Industry: Health Care Services

Name: Rite Aid Corporation
norm: rite aid
Domain: riteaid.com
Industry: Health Care Services
Industry: Healthcaresource defaultRetail & Consumerllm

Discovered: Nov 18, 2015
Breach occurred: Nov 19, 2014 – Nov 18, 2015
Undetected for: 364 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 976nationwide
Data types: Health (basic)Identity (basic)Financial credentials
HHS breach type: Unauthorized access or disclosure
Where the data lived: Desktop computerOther
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1530 Data from Cloud Storage
Threat actor: InternalFinancial
Regulator citations: OCR provided technical assistance on HIPAA Security Rule requirements including risk analyses, risk management plans, procedures to review information system activity, access controls for ePHI, and deployment of audit controls.
Initial access: insider_action

During the incident: Sanctioned employee responsible for breach
Revised payment card handling policies
Engaged with OCR on HIPAA Security Rule compliance
Changes made: Internal investigation conducted
Employee responsible terminated
Policy revised regarding handling of payment cards
One year of free credit monitoring services provided to affected individuals
Breach notification sent to HHS, affected individuals, and media
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(77 days from discovery to filing)
Compliance flags: HHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Nov 18, 2015
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Nov 18, 2015 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

HHS OCRFeb 3 · first · this page

Massachusetts State AG+6d

Pattern: first filing Feb 3 (NY), last Feb 9 (MA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Feb 3, 2016
Raw hash: 1bb4dbdab71aa8e47604ef3cff02e6fed0d5cfb5ac9f39a504a62db2a280cce1

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.1 KB

Download View at source

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityRite Aid Corporation

Victim entityRite Aid Corporation

Incidentdiscovered Nov 18, 2015

Stated responseSanctioned employee responsible for breach

ComplianceHHS notified

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing