Where does the CVS Pharmacy case file come from?

Every entry is taken from the breach report CVS Pharmacy lodged with the Massachusetts Attorney General. Nothing here is estimated.

Why do the incident date and the report date differ?

Companies usually investigate before they report. The gap between the two dates shows how long that took.

What does the records-affected figure count?

It is the number the company gave the state. It can cover residents of that state only, so the national total may be higher.

Does this case file change over time?

Yes. When a company files an update or a new state publishes its copy of the report, the dates and counts here are refreshed.

Case file

Case File: CVS Pharmacy Data Breach

This file collects the dated facts on record for the CVS Pharmacy incident. The state report is dated March 20, 2026.

Timeline

March 20, 2026Report filed in MassachusettsDate the notice was lodged with the Massachusetts Attorney General.

Case facts

Filing state: Massachusetts
Date reported: March 20, 2026
Receiving office: Massachusetts Attorney General

Case notes

CVS Pharmacy officially filed a report with the Massachusetts Attorney General on March 20, 2026, concerning a data security incident within its systems. This disclosure indicates that personal information handled by the company has been exposed.

At present, the specific nature of this breach, including the method of compromise and the exact categories of personal information involved, has not been publicly detailed. CVS Pharmacy has stated that an investigation into the incident is currently underway to ascertain its full extent and impact.

While the precise nature of the data involved remains under investigation, any compromise of personal information can lead to various risks for those affected. These risks might include unauthorized access to online accounts or attempts at identity-related fraud.

Individuals who receive a direct notification from CVS Pharmacy regarding this incident should take immediate steps to protect themselves. It is advisable to remain vigilant for any suspicious communications, regularly review financial and credit statements for unusual activity, and consider changing passwords for online accounts.

This case file documents the official reporting by CVS Pharmacy to regulatory authorities in Massachusetts. Further details will be added as more information becomes available from the ongoing investigation into this security event.

Questions about this case file

Where does the CVS Pharmacy case file come from?: Every entry is taken from the breach report CVS Pharmacy lodged with the Massachusetts Attorney General. Nothing here is estimated.
Why do the incident date and the report date differ?: Companies usually investigate before they report. The gap between the two dates shows how long that took.
What does the records-affected figure count?: It is the number the company gave the state. It can cover residents of that state only, so the national total may be higher.
Does this case file change over time?: Yes. When a company files an update or a new state publishes its copy of the report, the dates and counts here are refreshed.

Massachusetts data breaches

Named in the CVS Pharmacy breach?

Attach your notice and a short note. An attorney checks it against this case file at no cost.

Timeline

Case facts

Case notes

Questions about this case file

More Massachusetts case files