ShopRite Supermarkets, Inc., has revealed that some of its clients have been impacted by a security breach following the improper disposal of a device used to record customers’ signatures.
The device was stolen from the ShopRite outlet at Kingston, NY between 2005 and 2015 and held personal and medical information. Clients who visited the pharmacy and had prescriptions completed between 2005 and 2015 have possibly been impacted by the incident. For those clients, the device stored information inluding names, phone numbers, prescription details, dates and times of pickup or delivery, zip codes, medication names, and copies of customers’ signatures.
The device was also used for clients who purchased an over-the-counter product containing pseudoephedrine. Those clients have had their driver’s license number, zip code, details of the product bought, and personal and medical data exposed.
In the substitute breach notice published on the Wakefern Food Corp., website, customers have been told that the device was disposed of by mistake in February 2016, although ShopRite only revealed that a data security incident had happened on October 13, 2017.
ShopRight has not had any indication that the device has been accessed or misused in any way, although customers have been told to monitor their Explanation of Benefits statements from their insurers for any sign of improper use of their data. Customers have also been told to monitor their financial accounts for any evidence of fraud, although ShopRite does say that their Social Security numbers and financial data were not accessible at any point.
ShopRite has reacted to the incident by reviewing its security measures in relation to devices that store personal data and the removal and secure deletion of data from those devices prior to their disposal. Further privacy and security training has also been given to all pharmacy staff to help avoid further security breaches of this nature.
All clients affected by the security breach have now been advised by mail. The breach report filed to the Department of Health and Human Services’ Office for Civil Rights indicates 12,172 clients have been affected.
