HackingRetail & ConsumerHealthcareRetailVulnerability ExploitSupply Chain (3P Vendor)Customer Data InvolvedPHIHealth (basic)Identity (basic)LowContained

Rite Aid Corporation

bd_cf24171c42f0d172 · schema v1 · pii pii-v1

Severity

Low

Discovered

May 31, 2023

Filed

Jul 19, 2023

To disclose

7 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

65%

Full breach record for Rite Aid Corporation →10 incidents on file

Rite Aid Corporation disclosed a data breach involving a vulnerability in a vendor partner's software exploited by an unknown third party. The incident occurred on May 27, 2023, and was discovered on May 31, 2023. Affected data included limited protected health information (names, DOB, addresses, prescription info) but no SSNs or financial data. Rite Aid installed a patch, notified regulators/law enforcement, and offered one year of identity monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 4 days

discovery → filing · 7 weeks / 49 days

May 27, 2023

Begins

May 31, 2023

Discovered

Jul 19, 2023

Filed

vs. sector median

on median

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_4970b152db60cdc92023-07-11 · +8dVerified by operator

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_3c7717b2e2d8ec9b2023-07-19Verified
Washington State AGbd_4391b8c01e649ea82023-07-19Verified
HHS OCRbd_539cbd1ba62c4ed52023-07-19Verified

Name: Rite Aid Corporation
norm: rite aid
Domain: riteaid.com

Name: Rite Aid Corporation
norm: rite aid
Domain: riteaid.com
Industry: Retail & ConsumerllmHealthcarellm

Discovered: May 31, 2023
Breach occurred: May 27, 2023
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1195 Supply Chain Compromise
Threat actor: External
Regulator citations: Reported to law enforcementReported to appropriate federal and state regulators
Third party: via vendor partner
Initial access: supply_chain

During the incident: Installed the software update provided by the vendor
Conducted a thorough review of our systems and the provider’s software
Reported it to law enforcement
Reported it to the appropriate federal and state regulators
Secured the services of Kroll to provide identity monitoring at no cost for one year
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(49 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGJul 19 · first

Washington State AGJul 19 · first

HHS OCRJul 19 · first

California State AGJul 19 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-570564
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 19, 2023
Raw hash: be04c2b251d198be37276439659982bc8941d71f8553f66a739b6ce4c3b8eb3e

Linked disclosures

Ransomware claims (1)

Regulatory filings (3) · sorted by filing gap

Reporting entityRite Aid Corporation

Victim entityRite Aid Corporation

Incidentdiscovered May 31, 2023

Stated responseInstalled the software update provided by the vendor

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov