Cyber Incident Victim: PlanetDrugsDirect
Date:
Jan 2020
Location:
Canada
Summary
A Canadian online pharmacy experienced a security breach potentially compromising customers' personal, financial, and medical data, including names, contact details, prescriptions, and payment information. The incident, under investigation, did not affect account passwords; the company notified impacted individuals, urging vigilance with financial accounts and offering contact channels for assistance.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On or around January 15, 2020, Canadian online pharmacy PlanetDrugsDirect disclosed a data security incident impacting an undetermined number of its approximately 400,000 customers. The company, operating as a prescription referral service connecting customers to pharmacies and dispensaries, notified affected individuals via email that their sensitive personal, medical, and financial information may have been exposed. According to the notification, compromised data potentially included names, addresses, email addresses, phone numbers, medical information including prescriptions, and payment information. PlanetDrugsDirect explicitly stated there was no evidence that customer account passwords were accessed during the breach. The company confirmed the incident was under active investigation but did not specify when the breach occurred, how it was detected, or the exact number of affected individuals. Customers were advised that additional details would be provided as the investigation progressed, with PlanetDrugsDirect emphasizing efforts to rectify the situation while working diligently to complete their forensic examination.
The breach exposed extensive categories of sensitive data collected by PlanetDrugsDirect during normal operations, including occupation, employment status, physician contact details, biometric information (age, height, weight, sex, date of birth), drug allergies, family and personal medical histories, current medication details, and credit card information encompassing card type, number, expiration date, and cardholder name. In response to the incident, the company directed customers to monitor bank and credit card accounts for unusual activity and immediately notify financial institutions as well as PlanetDrugsDirect staff via the provided toll-free number (1-888-791-3784) or email address ([email protected]). Independent verification by BleepingComputer confirmed the breach through contact with PlanetDrugsDirect's call center, though representatives offered no further details beyond acknowledging the email notifications. The company reiterated its commitment to customer privacy and data protection in its communications but did not disclose specific containment measures, system vulnerabilities exploited, attacker methodologies, or remediation steps taken beyond the ongoing investigation.