Walgreens Class Action Claims Massive Data Breach

Walgreens failed to protect customers’ sensitive personal information and waited too long to inform them of a widespread data breach, according to a class action lawsuit.

Walgreens customer Laura Hernandez of Oakland Park, Fla. says she received notice from the pharmaceutical giant in early December 2019 that unauthorized third-parties had gained access to her name and contact information as well as other sensitive data such as her prescription history and program ID numbers.

This news prompted her to take steps to prevent further losses, reportedly consuming many hours of her time.

The Walgreens class action lawsuit states that she changed her login information on numerous websites, contacted her health insurance company to ensure no false claims had been made, checked bank and other financial account information for suspicious activity, and reviewed reports from the three major credit bureaus.

“To support these actions, Ms. Hernandez spent time doing the following: (a) determining through research and email history the identity of her medical providers over the past two years including pharmacies, primary care physicians and specialists; (b) contacting each provider personally by driving to each facility, taking time off work; (c) preparing personalized letters to each provider requesting medical records during 2018 and 2019; (d) following up over email and phone with each provider until confirmation was received that the medical records were ready; (e) reviewing all her account statements, prescription histories and medical records.”

Hernandez continues to monitor her accounts, devoting time and effort she would not have had to expend were it not for the data breach, the Walgreens class action lawsuit states.

“Plaintiff and Class Members have had to spend, and will continue to spend, significant amounts of time and money in an effort to protect themselves from the adverse ramifications of the Data Breach, and will forever be at a heightened risk of identity theft and fraud,” the Walgreens class action lawsuit alleges.

In addition, the Walgreens class action lawsuit claims the company waited two months to notify customers whose data had been breached, costing them valuable time in initiating their own extra precautions.

“While Walgreens discovered that its system had been compromised or about September 26, 2019, and identified affected customers by October 5, 2019, it failed to provide notice of the Data Breach until December 3, 2019,” according to the Walgreens class action lawsuit.

The filing cites Walgreens’ privacy policy, which states in part: “You trust us with your health and wellness needs, and we take that responsibility seriously. That includes making sure your data is safe and secure, and that you have control. We are committed to maintaining our customers’ privacy. We take great care to safeguard the information that we collect to maintain our customers’ privacy.”

However, the Walgreens class action lawsuit alleges that the company’s security was inadequate to make good on these assurances, despite having the resources to invest in such measures. As a direct result, it claims, many customers’ personal information fell into the hands of thieves.

The filing notes that data breaches in the health care sector, such as the Walgreens incident, involve extremely sensitive information and can have a crippling effect on their victims.

Criminals have been known to use this type of data to target victims with scams, gain access to prescription drugs and create false insurance claims, according to the Walgreens class action lawsuit.

“A report focusing on health-care breaches found that the ‘average total cost to resolve an identity theft-related incident … came to about $20,000,’ and that the victims were often forced to pay out-of-pocket costs for health care they did not receive in order to restore coverage,” states the Walgreens class action lawsuit.

“Almost 50 percent of the victims lost their health care coverage as a result of the incident, while nearly one third said their insurance premiums went up after the event.”

The Walgreens class action lawsuit claims violations of HIPAA and Federal Trade Commission guidelines, negligence, invasion of privacy, breach of implied contract, unjust enrichment, breach of fiduciary duty and violation of the Florida Unfair Deceptive Trade Practices Act.

The Walgreens class action lawsuit demands a jury trial in pursuit of damages, court costs and an injunction directing the company to implement “improved security procedures and measures” to safeguard its customers’ personal information.

Was your private information exposed in the Walgreens data breach? Let us know in the comment section below. 

Hernandez is represented by Carl V. Malmstrom of Wolf Haldenstein Adler Freeman & Herz LLC and by Jean Martin and Ryan McGee of Morgan & Morgan Complex Litigation Group.

The Walgreens Data Breach Class Action Lawsuit is Laura Hernandez v. Walgreen Company, Case No. 1:20-cv-02434, in the U.S. District Court for the Northern District of Illinois, Eastern Division.

Read More Lawsuit & Settlement News:

Walgreens Class Action Says Graham Crackers Need More Honey

What is LTD vs Short Term Disability Insurance?

Walgreens Settles Contacts Price-Fixing Class Action

What Does Colorado Lemon Law Cover?