CVS Pharmacy Data Breach Exposes Customer Information at Nearly 9,000 Locations CVS Pharmacy has disclosed a data breach affecting customers who purchased pet medications at approximately 9,000 of its nationwide locations. The incident raises concerns that sensitive customer information may have been exposed to unauthorized attackers. The breach was identified amid growing scrutiny over third-party risks in retail and pharmacy chains, where payment and personal data are frequently targeted. While CVS has not released specific details on the scope of the exposed data or the timeline of the breach, the company acknowledged that affected customers could include those who made transactions involving pet medications now widely available across its stores. The incident underscores the persistent vulnerabilities in supply chain and point-of-sale systems, particularly as retailers expand digital and in-store services. No further details on the attack vector or the number of impacted individuals have been confirmed. CVS continues to investigate the breach in coordination with cybersecurity experts.

CVS Pharmacy, Inc. suffered a cybersecurity incident that compromised the personal information of more than 6,000 consumers. An unauthorized party breached the company’s network servers and gained access to certain individuals’ names, addresses, and protected health information. CVS sent out data breach notification letters to those whose information was impacted in the breach.

On February 11, 2022, CVS Pharmacy experienced a data breach discovered on January 6, 2022, due to automated password spraying attacks targeting customer accounts. The incident potentially exposed sensitive personal information, including customer names, dates of birth, mailing addresses, email addresses, and limited prescription details. While the exact number of affected individuals remains undisclosed, the breach posed a significant risk of unauthorized access to customer data, raising concerns over identity theft, prescription fraud, or targeted phishing scams. The attack exploited weak or reused credentials, highlighting vulnerabilities in CVS’s authentication mechanisms. No ransomware was involved, but the compromise of prescription-related data—even if limited—intensified privacy and regulatory compliance risks under healthcare data protection laws like HIPAA. The breach underscored the need for stronger cybersecurity measures, such as multi-factor authentication (MFA) and monitoring for credential-stuffing attempts.

The California Office of the Attorney General reported that CVS Pharmacy, Inc. experienced a data breach involving unauthorized access to the CVSPhoto.com website between June 19, 2014, and July 14, 2015. The breach potentially affected customers' first and last names, payment card numbers, expiration dates, card verification codes, addresses, phone numbers, email addresses, and usernames and passwords, but not PIN numbers or photographic images. It is estimated that thousands of individuals' payment card information may have been compromised.