Notice of Data Incident Impacting Certain Cub Pharmacies
In late May, a number of Cub Pharmacies were among the many Minneapolis-area businesses that were looted during the civil unrest. Despite the security measures we had in place, some customer information was stolen.
During the events of May 27-30, 2020, eight Cub Pharmacies were broken into, during which time customer information was stolen from six of the pharmacies. These thefts included the removal of locked safes, binders containing past prescription records, and prescription orders that were in the process of being completed. We discovered some of these thefts immediately upon securing and reentering the stores (between May 28-30). More recently, a review of security video footage completed on June 20 identified additional customer information that was taken during the looting. Where possible, we’ve notified customers directly if their information was stolen but, unfortunately, we weren’t able to identify all potential customers in this manner.
The stolen information did not include social security numbers, drivers’ license numbers, date of birth or financial information that would enable someone to create or access a financial account. Accordingly, we do not believe that individuals are at increased risk of identity theft and we have not received any reports indicating the information has been misused in any way.
The Cub Pharmacies in which customer information was taken were: 701 West Broadway Avenue, Minneapolis, MN 55411; 3245 County Road 10, Brooklyn Center, MN 55430; 2850 26th Avenue South, Minneapolis, MN 55345; 1440 University Avenue West, St. Paul, MN 55104; 5937 Nicollet Avenue South, Minneapolis, MN 55419; and 1104 Lagoon Avenue, Minneapolis, MN 55408. At all six of these pharmacies, prescriptions waiting for customers to pick up were taken. Notification letters have been sent directly to these customers.
Specifically, at our Lake Street and Nicollet pharmacies, locked safes containing credit card authorization forms were stolen. The credit card authorization form would be completed by a customer if they wanted prescriptions delivered or mailed out to them. The credit card authorization forms that were in the stolen safes include cardholder name, credit card number, expiration date, and the date and amount of the transaction, but did not include the security code necessary to use the credit card information to make purchases online or over the phone. No credit card information for prescriptions purchased in-person at the pharmacy was stolen. We have no way of knowing whether the locked safes were forced open after they were stolen.
Also at the Lake Street location, a recent review of security footage indicated that looters took binders containing past prescription records that the pharmacy is required by law to retain. We do not know whose past prescription records were in the binders that were stolen from the Lake Street pharmacy. The information that was stolen would have included customer names, addresses, prescription numbers, drug names, drug quantities, ordering physician names and addresses, number of refills remaining, and prescription dates.
Again, because the stolen information did not include social security numbers, drivers’ license numbers, date of birth or financial information that would enable someone to create or access a financial account, we do not believe that individuals are at increased risk of identity theft and we have not received any reports indicating the information has been misused in any way.
Cub Pharmacies worked diligently to secure its pharmacies as soon as it was safe to do so and review the extent of the damage and thefts. We increased security to allow the pharmacies to reopen and continue to serve the community’s medical needs, where possible, while adding extra security to help protect against further theft. As soon as we were able, we spent countless hours reviewing multiple days of security footage to confirm whether any additional information had been compromised.
Cub Pharmacies does not believe there are any steps that customers need to take in response to this incident. We are notifying you about this incident through multiple channels out of an abundance of caution and care for our customers. We encourage customers with pharmacy prescriptions at these six locations to actively monitor their financial accounts and healthcare benefits for any health services or prescriptions that they do not recall receiving. Customers also should avoid providing personal information over the phone or internet unless they initiate the contact, such as if they receive a call or email claiming to be from Cub Pharmacies and seeking additional personal information.
If you have any questions, or to learn additional information, please contact the Cub Customer Interaction Center at (855) 282-3663.