HackingRetail & ConsumerRetailStolen CredentialsPhishingSupply Chain (3P Vendor)Customer Data InvolvedData ExfiltratedIdentity (basic)Government IDFinancial accountCredentialsHighActive

CVS Pharmacy, Inc.

bd_c170bb3c6ed5a8cb · schema v1 · pii pii-v1

Severity

High

Discovered

Jul 1, 2015

Filed

Sep 14, 2015

To disclose

11 weeks

Affected

5,840state residents only

Linked

4 filings

Confidence

64%

Full breach record for CVS Pharmacy, Inc. →9 incidents on file

CVS Pharmacy, Inc. disclosed that an illegal intrusion into third-party vendor PNI Digital Media's systems hosting CVSPhoto.com potentially exposed customer data including names, payment card details, and credentials between June 2014 and July 2015. CVS detected unusual activity in July 2015, took the site down, engaged forensic investigators, and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due11 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 395 days

discovery → filing · 11 weeks / 75 days

Jun 1, 2014

Begins

Jul 1, 2015

Discovered

Sep 14, 2015

Filed

vs. sector median

+3 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_8534ceb654eebac52015-09-11 · +3dVerified
California State AGbd_fc4af90e78d486c12015-09-11 · +3dCandidate
New Hampshire State AGbd_0146674d7aa449bb2015-09-10 · +4dVerified

Name: CVS Pharmacy, Inc.
norm: cvs pharmacy
Domain: cvs.com

Name: CVS Pharmacy, Inc.
norm: cvs pharmacy
Domain: cvs.com
Industry: Retail & Consumerllm

Discovered: Jul 1, 2015
Breach occurred: Jun 1, 2014 – Jul 1, 2015
Undetected for: 395 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 1, 2015
Affected individuals: 5,840state-resident count only
Data types: Identity (basic)Government IDFinancial accountCredentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Initial access: supply_chain

During the incident: Took down the CVSPhoto.com website
Began working with PNI to investigate
Working with experienced forensic investigators
Arranged for one year of free credit monitoring and resolution of identity theft through Experian’s ProtectMyID Alert
Advised the three major U.S. credit reporting agencies about this incident
Changes made: Reviewing the security practices for the vendor host
Working diligently to re-launch the website
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(75 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

New Hampshire State AGSep 10 · first

Massachusetts State AG+1d

California State AG+1d

South Carolina State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/CVS.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 14, 2015
Raw hash: 08e75df26eae3c2dee081151886afbf66d06b31531cd71008063b9b6b5e89f1a

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityCVS Pharmacy, Inc.

Victim entityCVS Pharmacy, Inc.

Incidentdiscovered Jul 1, 2015

Stated responseTook down the CVSPhoto.com website

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov