Kmart Corporation kmart.com Kmart data breach: what happened and what to do
In 2014, printed pharmacy reports listing patients' names, addresses, prescribers and medications were shared with an acquaintance of a former Kmart pharmacy employee in Sebring, Florida. It was a disclosure, not a hack. No financial data is listed.
View all 13,177 breaches- Breach date
- 10 Feb 2014
- Made public
- 10 Feb 2014
- Data exposed
- Names, Physical addresses, Medical information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Kmart Corporation reported to the U.S. Department of Health and Human Services (HHS) that printed pharmacy reports containing patients' health information were disclosed to an acquaintance of a former employee at its pharmacy in Sebring, Florida. HHS's Office for Civil Rights (OCR) posted the case on its public breach portal in February 2014.
This was not an attack on Kmart's systems. Paper reports left the pharmacy and reached someone who had no right to see them.
Sources checked: ocrportal.hhs.gov, identitytheft.gov, consumer.ftc.gov
Last verified against the official page:
What was exposed
The reports covered patients' names, addresses, prescribers and the medications they were prescribed. HHS's case summary doesn't list Social Security numbers, card numbers or bank details.
A medication list can still say a lot about a person. Anyone holding it knows who you are, where you live and what you take. That is enough for a convincing phone call or letter from someone claiming to be your pharmacy, insurer or doctor's office.
What Kmart did
According to HHS, Kmart notified HHS, the affected patients and the media. It also contacted law enforcement and reminded pharmacy staff of its HIPAA policies on using, disclosing and safeguarding patient information. OCR obtained written assurances that Kmart had put these corrective actions in place.
What to do
If you filled prescriptions at the Sebring Kmart pharmacy around then, check whether you got a notice letter. The steps below match what the FTC recommends after a leak of personal information.
What to do if you were in it
- 1
Read your notice letter
If Kmart wrote to you, the letter explains what was in your file. Keep it with your records.
- 2
Expect calls and letters that mention your medications
Don't give out personal or insurance details to someone who contacts you first. Hang up and call the number on your pharmacy card or insurance card yourself.
- 3
Read your insurance statements
Look for claims or prescriptions you don't recognise and report them to your insurer. The FTC's guidance on medical identity theft is at identitytheft.gov.
- 4
Check whether your email or phone is in other breaches
Run a free Serus scan to see whether your email or phone number appears in breach databases. Serus can't remove breach data, but it alerts you and tells you what to do.
Official filings
- U.S. Department of Health and Human Services , filed 10 Feb 2014 : 16,446 people
- U.S. Department of Health and Human Services , filed 3 Apr 2013 : 12,542 people
Timeline
-
Reported to U.S. Department of Health and Human Services
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Kmart breach?
Only if you filled prescriptions at the Kmart pharmacy in Sebring, Florida around the time of the disclosure. Kmart was required to send those patients a notice.
What was exposed?
Names, addresses, prescribers and medications, according to HHS's case description.
Were my card or Social Security number exposed?
HHS's case description doesn't list either.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
