HackingRetail & ConsumerRetailStolen CredentialsTargetedCustomer Data InvolvedIdentity (basic)Government IDCriticalContained

Rite Aid Corporation

bd_f56081669f275cda · schema v1 · pii pii-v1

Severity

Critical

Discovered

Jun 6, 2024

Filed

Jul 15, 2024

To disclose

6 weeks

Affected · nationwide

2,200,00030,137 in this filing

Linked

13 records

Confidence

66%

Full breach record for Rite Aid Corporation →11 incidents on file

Rite Aid Corporation reported an external system breach on June 6, 2024, where an unknown third party compromised business credentials to access systems. Data acquired included names, addresses, dates of birth, and driver's license numbers for purchases made between June 2017 and July 2018. Approximately 2.2 million individuals were affected, including 30,137 Maine residents. Rite Aid notified affected individuals on July 15, 2024, and offered 12 months of identity monitoring through Kroll.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jun 6, 2024 → Filed with AG Jul 15, 202439d ⏱ ME AG >30d6 weeks discovery → filing

Incident timeline

discovery → filing · 6 weeks / 39 days

Jun 6, 2024

Begins

Jun 6, 2024

Discovered

Jul 15, 2024

Filed

vs. sector median

4 wks faster

This filing is one of 13 records about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Montana State AGbd_207d49685b6d18df2024-07-15Verified
California State AGbd_4ecedaca9ccb33242024-07-15Verified
South Carolina State AGbd_5dc09de29a4959d72024-07-15Verified
Massachusetts State AGbd_666fbc5335615f552024-07-15Verified

Show 6 more filings ↓

Oregon State AGbd_889db9b4ae4e89f72024-07-15Verified
Vermont State AGbd_a417384d21d4f0c12024-07-15Verified
Washington State AGbd_b4a3decb3cef61212024-07-15Verified
Indiana State AGbd_c885a91972cf27f32024-07-15Verified
Delaware State AGbd_e9b3a4c075cb2fda2024-07-15Verified
New Hampshire State AGbd_eefa59da13cd37842024-07-15Verified

Showing first 10 of 12 linked disclosures.

Name: Rite Aid Corporation
norm: rite aid
Domain: riteaid.com

Name: Rite Aid Corporation
norm: rite aid
Domain: riteaid.com
Industry: Retail & Consumerllm

Discovered: Jun 6, 2024
Breach occurred: Jun 6, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 15, 2024
Affected individuals: 2,200,000state + nationwide
Data types: Identity (basic)Government ID
Data elements: Date of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Reported to federal and state regulators
Initial access: valid_credentials

During the incident: Reported to law enforcement
Reported to federal and state regulators
Secured services of Kroll to provide identity monitoring
Launched internal investigation
Terminated unauthorized access
Remediated affected systems
Changes made: Implementing additional security measures to prevent potentially similar attacks
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(39 days from discovery to filing)
Compliance flags: ME AG >30d · 39dME CRA notice due
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jun 6, 2024
→ Filed with AG: Jul 15, 2024
39d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jun 6, 2024 → Filed with AG: Jul 15, 2024	39d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 11 states

View merged incident ↗

Montana State AGJul 15 · first

California State AGJul 15 · first

South Carolina State AGJul 15 · first

Massachusetts State AGJul 15 · first

Oregon State AGJul 15 · first

Vermont State AGJul 15 · first

Washington State AGJul 15 · first

Indiana State AGJul 15 · first

Delaware State AGJul 15 · first

New Hampshire State AGJul 15 · first

Maine State AGJul 15 · first · this page

Cascade drawn from the first 10 linked disclosures of 12 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/c4bace65-85df-4fff-b99f-f8fd390bb41a.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 15, 2024
Raw hash: 2253175f1275d4a8add051bb3f9cf5c6b4d62479d5d1fde4b5d9bd6bfb99e80e

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityRite Aid Corporation

Victim entityRite Aid Corporation

Incidentdiscovered Jun 6, 2024

Stated responseReported to law enforcement

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov