An Amazon-owned pharmaceuticals retail company, PillPack suffered a major data security incident in April that involved a threat actor accessing the sensitive information of more than 19,000 customers.
PillPack, a certified US retail pharmacy that was founded in 2013 and acquired by Amazon five years later, delivers medications and other pharmaceutical products in all 50 US states and the District of Columbia. The company delivers medications pre-sorted into packets by time of day and also delivers eye drops, creams, insulin, and inhalers.
PillPack said in a recent security notice posted on its website that on April 3, it identified suspicious login attempts to its customer accounts on PillPack.com. The company immediately launched an investigation to understand the nature and scope of the security incident.
Upon investigation, PillPack “determined that between April 2 and April 6, 2023, an unauthorised person used customers’ e-mail addresses and passwords to log in to their PillPack.com accounts.”
“Our investigation confirmed that no e-mail addresses or passwords were taken from PillPack, and our systems are secure. Instead, it’s most likely that the unauthorised person was able to log in to the PillPack accounts because customers used the same e-mail and password for another website where they got the information,” PillPack said.
The security incident compromised customers’ personal details such as their email addresses, information related to their PillPack prescriptions, and contact information for their prescribing provider. PillPack confirmed that the threat actor gained unauthorised access to 19,032 accounts in total, and 3,614 of those accounts contained prescription information.
PillPack has clarified that customers’ social security numbers and payment card information were not compromised by the security incident.
While the company is confident that the information viewed during the unauthorised access has not been misused, the possibility of the same cannot be ruled out.
“There is no evidence that the information viewed has been used in any way, and there has been no unusual activity on the impacted accounts. The limited information that was revealed is not enough to steal someone’s identity.
“This event was limited to PillPack, and we both notified the impacted customers directly and posted the notification to our website,” a PillPack spokesperson told Healthcare Dive.
Following the security incident, the company has reset all account passwords and has enabled multi-factor authentication on all accounts to prevent any further unauthorised access and protect customer accounts. It said all affected individuals will be notified about the security incident by July 2.
