Company Details
cvs-health
122,928
965,649
62
cvshealth.com
0
CVS_1676450
In-progress

CVS Health Company CyberSecurity Posture
cvshealth.comCVS Health is the leading health solutions company, delivering care like no one else can. We reach more people and improve the health of communities across America through our local presence, digital channels and over 300,000 dedicated colleagues – including more than 40,000 physicians, pharmacists, nurses and nurse practitioners. Wherever and whenever people need us, we help them with their health – whether that’s managing chronic diseases, staying compliant with their medications or accessing affordable health and wellness services in the most convenient ways. We help people navigate the health care system – and their personal health care – by improving access, lowering costs and being a trusted partner for every meaningful moment of health. And we do it all with heart, each and every day. Follow @CVSHealth on social media.
Company Details
cvs-health
122,928
965,649
62
cvshealth.com
0
CVS_1676450
In-progress
Between 800 and 849

CVS Health Global Score (TPRM)XXXX

Description: The Missouri Attorney General’s Office reported a data breach involving Aetna Life Insurance Company on December 1, 2023. The breach occurred on May 29, 2023, and compromised the personal information of 11,893 Missouri residents, specifically exposing Social Security Numbers. This incident highlights the vulnerability of personal data and the potential consequences of such breaches on individuals' privacy and security.
Description: Aetna sufferd from a data security incident that exposed More than 500 Texans personal information online. The exposed information includes first name, last name, Aetna member identification number, provider information, claim payment amount, and in some cases procedure/service codes and dates of service. Social Security numbers, bank account information, or credit card details did not exposed in this incident. They launched the investigation and started notifying the affected individuals.
Description: Over a billion customer records of Pharmacy giant CVS were leaked on internet in a cyber incident. The exposed data included customer email addresses, device IDs, and the order histories of CVS. Upon learning about the incident CVS Health immediately worked to secure the data and informed the impacted customers to remain alert.
Description: The Washington State Office of the Attorney General reported a data breach involving CVS Caremark Part D Services, L.L.C. on February 23, 2024. The breach occurred on November 20, 2023, due to human error in mailing processes, affecting approximately 2,193 individuals' names and medical information.
Description: On April 8, 2024, the Maine Office of the Attorney General reported a data breach involving CVS that occurred on January 1, 2023. The breach was an internal system breach affecting a total of 10 individuals, with consumer notification conducted electronically on January 10, 2023. Identity theft protection services were offered.


No incidents recorded for CVS Health in 2025.
No incidents recorded for CVS Health in 2025.
No incidents recorded for CVS Health in 2025.
CVS Health cyber incidents detection timeline including parent company and subsidiaries

CVS Health is the leading health solutions company, delivering care like no one else can. We reach more people and improve the health of communities across America through our local presence, digital channels and over 300,000 dedicated colleagues – including more than 40,000 physicians, pharmacists, nurses and nurse practitioners. Wherever and whenever people need us, we help them with their health – whether that’s managing chronic diseases, staying compliant with their medications or accessing affordable health and wellness services in the most convenient ways. We help people navigate the health care system – and their personal health care – by improving access, lowering costs and being a trusted partner for every meaningful moment of health. And we do it all with heart, each and every day. Follow @CVSHealth on social media.

Every day millions of people feel the impact of our intelligent devices, advanced analytics and artificial intelligence. As a leading global medical technology and digital solutions innovator, GE HealthCare enables clinicians to make faster, more informed decisions through intelligent devices, data
IQVIA (NYSE:IQV) is a leading global provider of clinical research services, commercial insights and healthcare intelligence to the life sciences and healthcare industries. IQVIA’s portfolio of solutions are powered by IQVIA Connected Intelligence™ to deliver actionable insights and services built o

A world-leading integrated healthcare provider, IHH believes that making a difference starts with our aspiration to Care. For Good. Our team of 65,000 people commit to deliver greater good to our patients, people, the public and our planet, as we live our purpose each day to touch lives and trans

Our mission is to improve the health and well-being of North Carolinians and others whom we serve. We accomplish this by providing leadership and excellence in the interrelated areas of patient care, education and research. UNC Health and its 33,000 employees, continue to serve as North Carolina’s
Sharp HealthCare is a not-for-profit health care system based in San Diego, California, with four acute care hospitals, three specialty hospitals, three medical groups and a health plan. We provide medical services in virtually all fields of medicine, including primary care, heart care, cancer, orth

Thomas Jefferson University and Thomas Jefferson University Hospitals are partners in providing excellent clinical and compassionate care for our patients in the Philadelphia region, educating the health professionals of tomorrow in a variety of disciplines and discovering new knowledge that will de

As the only Idaho-based, not-for-profit health system, St. Luke’s Health System is dedicated to our mission “To improve the health of people in the communities we serve.” Today that means not only treating you when you’re sick or hurt, but doing everything we can to help you be as healthy as possibl
A Dasa é a maior rede de saúde integrada do Brasil. Faz parte da vida de mais de 20 milhões de pessoas por ano, com alta tecnologia, experiência intuitiva e atitude à frente do tempo. Com mais de 50 mil colaboradores e 250 mil médicos parceiros, existe para ser a saúde que as pessoas desejam e que

We’re evolving health care so everyone can have the opportunity to live their healthiest life. It’s why we put your unique needs at the heart of everything we do, making it easy and affordable to manage health and well-being. We are delivering the right care how and when it’s needed; providing suppo
.png)
Union workers at CVS pharmacies said they are holding a national day of action in response to working in unsafe conditions.
A California federal judge has refused to release CVS Pharmacy Inc. and a marketing partner from a putative class action accusing them of...
CVS Health has completed the acquisition of 63 Rite Aid stores in Idaho, Oregon and Washington and prescription files across 15 states that...
CVS Health is facing a probe into potential HIPAA violations related to the alleged use of patient data for lobbying purposes to prevent the...
by Rod Wallace on 04 AUG 2025 in AWS Security Hub, Customer Solutions, Open Source, Security, Security, Identity, & Compliance, Thought Leadership Permalink...
Microsoft's rural health program gives providers free access to cybersecurity assessments, cyber awareness training and tech product support.
An in-depth look into the personal and professional experiences of Michael Streuling from this year's Washington Foster Class of 2026.
Chandra McMahon is a seasoned cybersecurity executive and board member with over 30 years of experience leading complex security and technology programs.
CVS Health, Walgreens and grocery store chains Kroger and Albertsons are among the pharmacy operators buying more than 1,000 Rite Aid...

Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
The official website of CVS Health is http://CVSHealth.com.
According to Rankiteo, CVS Health’s AI-generated cybersecurity score is 814, reflecting their Good security posture.
According to Rankiteo, CVS Health currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
According to Rankiteo, CVS Health is not certified under SOC 2 Type 1.
According to Rankiteo, CVS Health does not hold a SOC 2 Type 2 certification.
According to Rankiteo, CVS Health is not listed as GDPR compliant.
According to Rankiteo, CVS Health does not currently maintain PCI DSS compliance.
According to Rankiteo, CVS Health is not compliant with HIPAA regulations.
According to Rankiteo,CVS Health is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
CVS Health operates primarily in the Hospitals and Health Care industry.
CVS Health employs approximately 122,928 people worldwide.
CVS Health presently has no subsidiaries across any sectors.
CVS Health’s official LinkedIn profile has approximately 965,649 followers.
CVS Health is classified under the NAICS code 62, which corresponds to Health Care and Social Assistance.
No, CVS Health does not have a profile on Crunchbase.
Yes, CVS Health maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/cvs-health.
As of December 11, 2025, Rankiteo reports that CVS Health has experienced 5 cybersecurity incidents.
CVS Health has an estimated 30,928 peer or competitor companies worldwide.
Incident Types: The types of cybersecurity incidents that have occurred include Data Leak and Breach.
Detection and Response: The company detects and responds to cybersecurity incidents through an containment measures with immediately worked to secure the data, and communication strategy with informed the impacted customers to remain alert, and communication strategy with notifying affected individuals, and communication strategy with consumer notification conducted electronically..
Title: CVS Data Leak Incident
Description: Over a billion customer records of Pharmacy giant CVS were leaked on the internet in a cyber incident.
Type: Data Breach
Title: Aetna Data Security Incident
Description: Aetna suffered from a data security incident that exposed more than 500 Texans' personal information online. The exposed information includes first name, last name, Aetna member identification number, provider information, claim payment amount, and in some cases procedure/service codes and dates of service. Social Security numbers, bank account information, or credit card details were not exposed in this incident. They launched an investigation and started notifying the affected individuals.
Type: Data Breach
Title: CVS Data Breach
Description: A data breach involving CVS was reported by the Maine Office of the Attorney General, affecting 10 individuals.
Date Detected: 2023-01-01
Date Publicly Disclosed: 2024-04-08
Type: Data Breach
Attack Vector: Internal System Breach
Title: Aetna Life Insurance Company Data Breach
Description: The Missouri Attorney General’s Office reported a data breach involving Aetna Life Insurance Company on December 1, 2023. The breach occurred on May 29, 2023, and compromised the personal information of 11,893 Missouri residents, specifically exposing Social Security Numbers.
Date Detected: 2023-12-01
Date Publicly Disclosed: 2023-12-01
Type: Data Breach
Title: CVS Caremark Part D Services Data Breach
Description: The Washington State Office of the Attorney General reported a data breach involving CVS Caremark Part D Services, L.L.C. on February 23, 2024. The breach occurred on November 20, 2023, due to human error in mailing processes, affecting approximately 2,193 individuals' names and medical information.
Date Detected: 2023-11-20
Date Publicly Disclosed: 2024-02-23
Type: Data Breach
Attack Vector: Human Error
Vulnerability Exploited: Mailing Processes
Common Attack Types: The most common types of attacks the company has faced is Breach.

Data Compromised: Customer email addresses, Device ids, Order histories

Data Compromised: First name, Last name, Aetna member identification number, Provider information, Claim payment amount, Procedure/service codes, Dates of service

Data Compromised: Social security numbers

Data Compromised: Names, Medical information
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Customer Email Addresses, Device Ids, Order Histories, , First Name, Last Name, Aetna Member Identification Number, Provider Information, Claim Payment Amount, Procedure/Service Codes, Dates Of Service, , Social Security Numbers, Names, Medical Information and .

Entity Name: CVS
Entity Type: Pharmacy
Industry: Healthcare
Size: Large
Customers Affected: Over a billion

Entity Name: Aetna
Entity Type: Healthcare Insurance Provider
Industry: Healthcare
Location: Texas
Customers Affected: More than 500 Texans

Entity Name: CVS
Entity Type: Company
Industry: Healthcare
Customers Affected: 10

Entity Name: Aetna Life Insurance Company
Entity Type: Insurance Company
Industry: Health Insurance
Location: Missouri
Customers Affected: 11893

Entity Name: CVS Caremark Part D Services, L.L.C.
Entity Type: Company
Industry: Healthcare
Customers Affected: 2193

Incident Response Plan Activated: True
Containment Measures: Immediately worked to secure the data
Communication Strategy: Informed the impacted customers to remain alert

Communication Strategy: Notifying affected individuals

Communication Strategy: Consumer notification conducted electronically

Type of Data Compromised: Customer email addresses, Device ids, Order histories
Number of Records Exposed: Over a billion

Type of Data Compromised: First name, Last name, Aetna member identification number, Provider information, Claim payment amount, Procedure/service codes, Dates of service
Number of Records Exposed: More than 500

Number of Records Exposed: 10

Type of Data Compromised: Social Security Numbers
Number of Records Exposed: 11893
Sensitivity of Data: High
Personally Identifiable Information: Social Security Numbers

Type of Data Compromised: Names, Medical information
Number of Records Exposed: 2193
Sensitivity of Data: High
Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by immediately worked to secure the data.

Source: Maine Office of the Attorney General
Date Accessed: 2024-04-08

Source: Missouri Attorney General’s Office
Date Accessed: 2023-12-01

Source: Washington State Office of the Attorney General
Date Accessed: 2024-02-23
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Maine Office of the Attorney GeneralDate Accessed: 2024-04-08, and Source: Missouri Attorney General’s OfficeDate Accessed: 2023-12-01, and Source: Washington State Office of the Attorney GeneralDate Accessed: 2024-02-23.

Investigation Status: Launched
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Informed the impacted customers to remain alert, Notifying affected individuals and Consumer notification conducted electronically.

Customer Advisories: Informed the impacted customers to remain alert

Customer Advisories: Identity theft protection services were offered
Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Informed the impacted customers to remain alert and Identity theft protection services were offered.

Root Causes: Human Error in Mailing Processes
Most Recent Incident Detected: The most recent incident detected was on 2023-01-01.
Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2024-02-23.
Most Significant Data Compromised: The most significant data compromised in an incident were customer email addresses, device IDs, order histories, , first name, last name, Aetna member identification number, provider information, claim payment amount, procedure/service codes, dates of service, , Social Security Numbers, , Names, Medical Information and .
Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident was Immediately worked to secure the data.
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were claim payment amount, dates of service, last name, Social Security Numbers, Aetna member identification number, provider information, customer email addresses, Names, device IDs, Medical Information, first name, procedure/service codes and order histories.
Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 943.0.
Most Recent Source: The most recent source of information about an incident are Missouri Attorney General’s Office, Washington State Office of the Attorney General and Maine Office of the Attorney General.
Current Status of Most Recent Investigation: The current status of the most recent investigation is Launched.
Most Recent Customer Advisory: The most recent customer advisory issued were an Informed the impacted customers to remain alert and Identity theft protection services were offered.
.png)
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions prior to 16.0.96 and 17.0.1 through 17.0.9 have a weak default password. By default, this is a 6 digit numeric value which can be brute forced. (This is the app_password parameter). Depending on local configuration, this password could be the extension, voicemail, user manager, DPMA or EPM phone admin password. This issue is fixed in versions 16.0.96 and 17.0.10.
Neuron is a PHP framework for creating and orchestrating AI Agents. In versions 2.8.11 and below, the MySQLWriteTool executes arbitrary SQL provided by the caller using PDO::prepare() + execute() without semantic restrictions. This is consistent with the name (“write tool”), but in an LLM/agent context it becomes a high-risk capability: prompt injection or indirect prompt manipulation can cause execution of destructive queries such as DROP TABLE, TRUNCATE, DELETE, ALTER, or privilege-related statements (subject to DB permissions). Deployments that expose an agent with MySQLWriteTool enabled to untrusted input and/or run the tool with a DB user that has broad privileges are impacted. This issue is fixed in version 2.8.12.
Neuron is a PHP framework for creating and orchestrating AI Agents. Versions 2.8.11 and below use MySQLSelectTool, which is vulnerable to Read-Only Bypass. MySQLSelectTool is intended to be a read-only SQL tool (e.g., for LLM agent querying, however, validation based on the first keyword (e.g., SELECT) and a forbidden-keyword list does not block file-writing constructs such as INTO OUTFILE / INTO DUMPFILE. As a result, an attacker who can influence the tool input (e.g., via prompt injection through a public agent endpoint) may write arbitrary files to the DB server if the MySQL/MariaDB account has the FILE privilege and server configuration permits writes to a useful location (e.g., a web-accessible directory). This issue is fixed in version 2.8.12.
Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response. This issue is fixed in version 20.0.1.
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. When using versions 4.11.0 through 4.11.2 and 4.12.0, simultaneous requests on the same client may result in improper lookups in the TokenRequestCache for the request results. This issue is fixed in versions 4.11.2 and 4.12.1.

Get company history
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
