Student Loans, Hotels & Auto · Pharmacy · Regulatory action + Data breach
Rite Aid
Headline
A May 2023 breach affecting up to 24,400 customers and a confirmed June 2024 ransomware breach affecting about 2.2 million customers exposed personal information, and Rite Aid carries a second finding that matters more…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
A May 2023 breach affecting up to 24,400 customers and a confirmed June 2024 ransomware breach affecting about 2.2 million customers exposed personal information, and Rite Aid carries a second finding that matters more: the FTC's action over its use of facial recognition in stores, which the Commission alleged generated thousands of false matches and disproportionately flagged women and people of colour, leading to customers being followed, searched, publicly accused and in some cases reported to police for crimes they had not committed. The resulting order barred Rite Aid from using facial recognition for surveillance for five years. That is one of the few findings anywhere in this tracker where the harm was not abstract data exposure but a person being detained in a shop.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected.
Data sharing
MULTIPLE SEPARATE FINDINGS: (1) A May 2023 breach (data theft confirmed May 26, 2023, via an exploited vulnerability) compromised names, birth dates, addresses, prescription and limited insurance information of up to 24,400 customers; Social Security numbers and financial information were not exposed (per HIPAA Journal, July 2023). (2) A JUNE 2024 breach (RansomHub ransomware group) affected approximately 2.2 MILLION customers — a hacker IMPERSONATING AN EMPLOYEE gained access to systems; Rite Aid identified the intrusion within 12 hours but not fast enough to prevent data theft (names, addresses, birthdates, driver's license/government ID numbers for customers who made purchases between June 6, 2017 and July 30, 2018). Rite Aid settled the resulting class action (Bianucci v. Rite Aid) for $6.8 MILLION (final approval hearing reported for July 17, 2025; the approval order itself was not retrieved), offering up to $10,000 for documented losses. (3) SEPARATE, EARLIER LAWSUIT (2023): alleged Rite Aid disclosed website visitors' personal AND HEALTH information to Meta and other third parties without consent — the same Meta Pixel/pharmacy-data pattern documented for Kroger elsewhere in this tracker.
Fees and billing
COMPLICATING FACTOR: Rite Aid FILED FOR BANKRUPTCY (a SECOND time, following an earlier 2023 Chapter 11) during the pendency of the data-breach settlement — the settlement's own FAQ page explicitly states 'the parties are evaluating the potential impact that Rite Aid's bankruptcy filing may have on the settlement,' meaning the payout could be affected by the bankruptcy; the federal court in Pennsylvania nonetheless granted final approval of the $6.8 million settlement around Aug. 1, 2025 (Law360), and how the bankruptcy has affected actual payments was not verified as of Oct 2026.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy riteaid.com/legal/privacy-policy | Not fetched yet | NO (HTML only) |
| Terms of service riteaid.com/legal/terms-of-use | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
| Action | Amount | Link |
|---|---|---|
| In re Rite Aid Corporation Federal Trade Commission, 2023 FTC Decision and Order December 2023. | — | candidate needs review |
Links are proposed matches, not yet reviewed.
State statute
No HQ state on file, so no state statute applies by headquarters.