Texas AG Cites CVS Pharmacy for Exposing Customer Records

Texas Attorney General Greg Abbott on April 17 took legal action against CVS Pharmacy for exposing its customers to identity theft. According to court documents filed by Abbott, CVS violated a 2005 law requiring businesses to protect any customer records that contain sensitive customer information, including credit and debit card numbers.

Investigators with the Office of the Attorney General (OAG) discovered that a CVS store in Liberty, near Houston, exposed hundreds of its customers to identity theft by failing to properly dispose of records that contained sensitive information. The investigation was launched after reports indicated that bulk customer records were tossed in a dumpster behind the store. Investigators also found several medical prescription forms that included each customer’s name, address, date of birth, issuing physician and the types of medication prescribed. The documents obtained by OAG investigators also contained hundreds of active debit and credit card numbers, complete with expiration dates.

CVS is accused of violating the 2005 Identity Theft Enforcement and Protection Act, which requires businesses to protect and properly dispose of documents that include clients’ sensitive personal information. Under the law, the OAG has the authority to seek penalties of up to $50,000 per violation.

The Attorney General also charged CVS with violating Chapter 35 of the Business and Commerce Code, which requires businesses to develop retention and disposal procedures for their clients’ personal information. The law provides for civil penalties of up to $500 for each abandoned record.

Attorney General investigators are also working to determine if any exposed data has been used illegally. Consumers who interacted with CVS’ Liberty location should carefully monitor their bank, credit card and any similar statements for evidence of suspicious activity. Customers should also consider obtaining free copies of their credit reports.

Consumers who wish to file a complaint may contact the Office of the Attorney General at (800) 252-8011 or file a complaint online at www.oag.state.tx.us. Consumers can also obtain information on how to detect and prevent identity theft.

Source: Texas Attorney General’s Office