Ridgeway Pharmacy Website Security Incident Exposes Sensitive Customer Data

Morningstar

Ridgeway Pharmacy Website Security Incident Exposes Sensitive Customer Data

First seen 22 Sep 2026, 08:53 UTC • •39.1

Article Content

1 / 4

Browse articles

ThreatCluster •September 23, 2026 at 08:26 UTC

•Unauthorized access to Ridgeway Pharmacy's website due to a third-party vendor vulnerability.
•Potential exposure of sensitive customer data, including health and payment information.
•Ridgeway is offering complimentary identity protection services to affected individuals.

Ridgeway Pharmacy reported a security incident involving its pharmacy website, developed by a third-party vendor. An investigation revealed that a vulnerability allowed unauthorized access to the site, potentially exposing sensitive information such as names, dates of birth, addresses, prescription details, health information, insurance data, and payment card information. The incident was discovered on August 21, 2026, and affected individuals have been notified. Ridgeway has since secured the website, implemented additional protections, and reported the incident to federal law enforcement. They are offering complimentary identity protection services to those affected. The incident did not involve Ridgeway's internal systems.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 3h ago How this analysis works

Timeline

2026-08-21

Vulnerability discovered

Ridgeway identified unauthorized access to its pharmacy website due to a vulnerability in the vendor-supported platform.

2026-09-21

Incident reported publicly

Ridgeway Pharmacy issued a statement detailing the security incident and the steps taken to remediate the issue.

2026-09-22

Public notice published

Ridgeway Pharmacy's statement regarding the incident was also published on PR Newswire, reiterating the details and response actions.

www.prnewswire.com

More articles in this cluster (3)

Threat Graph

5 entities, 4 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Data Breach
T1068 - Exploitation for Privilege Escalation
T1190 - Exploit Public-Facing Application

Weakness (2)

CWE-200 - Exposure of Sensitive Information
CWE-269 - Improper Privilege Management

Relationships

Data Breach related to CWE-200 - Exposure of Sensitive Information
Data Breach related to CWE-269 - Improper Privilege Management
Data Breach related to T1068 - Exploitation for Privilege Escalation
Data Breach related to T1190 - Exploit Public-Facing Application

Continue Reading

Critical Zero-Day Vulnerability in F5 BIG-IP APM Exploited for Remote Code Execution F5 Networks has reported a critical vulnerability in its BIG-IP Access Policy Manager (APM), tracked as CVE-2026-94127, which is being actively exploited in the wild. The flaw allows unauthenticated attackers to execute remote code on systems configured with both an APM access policy and an OAuth profile. This…

Massive Network of AI Proxy Servers Used for Malicious Activities Uncovered Security researchers from Team Cymru have identified over 10,000 proxy servers in China facilitating malicious AI activities. These servers, termed 'transfer stations,' are primarily used to bypass geographic restrictions and conduct model distillation attacks against frontier AI models. The infrastructure allows…