In February 2024, Allium UPI, the parent company of the Estonian pharmacy chain Apotheka, suffered a major data breach orchestrated by a 25-year-old Moroccan suspect, Adrar Khalid. The attacker exploited administrator credentials to unlawfully access and download sensitive customer data from the company’s loyalty program database. The breach exposed nearly 700,000 personal identification codes, 400,000+ email addresses, 60,000 home addresses, 30,000 phone numbers, and purchase records (non-prescription medications and pharmacy products dating back to 2014). While no misuse of the stolen data has been detected yet, the incident compromised a vast trove of personally identifiable information (PII) and transaction histories, posing significant risks of identity theft, phishing, or fraud. Estonian authorities have launched an international manhunt for Khalid, seeking his arrest and extradition. The breach underscores vulnerabilities in privileged access management and highlights the growing threat of targeted cyber intrusions in healthcare-related sectors.