Ridgeway Pharmacy data breach: prescriptions and card details taken through its website

What happened at Ridgeway Pharmacy?

Ridgeway says it investigated with outside cybersecurity and forensic specialists, reported the incident to federal law enforcement, and reviewed what the website vendor gave it. It says none of its internal systems were involved. It has rebuilt the website on a new platform, restricted access, strengthened monitoring and reviewed its arrangements with the vendors behind the site.

Date	What the letter and the regulators' records say
June 7, 2026	Breach date on the California and Indiana records
August 21, 2026	Ridgeway learns that customers' information may be involved
September 21, 2026	Report to HHS; recorded by California, Indiana and Massachusetts
September 25, 2026	Posted by Texas (33,485 Texans)

What information was involved in the Ridgeway Pharmacy breach?

The letter lists address, date of birth, health information, insurance information, name, payment card information and prescription information. It says Social Security numbers, driver's license numbers and other sensitive information were not involved.

Information	In the letter	Massachusetts record
Payment card information	Involved	Credit or debit numbers marked as breached
Prescription, health and insurance information	Involved	Medical records not marked
Name, address, date of birth	Involved	Not a category
Social Security and driver's license numbers	Not involved	Not marked

Because payment card numbers are on the list, the card used on Ridgeway's website is the first thing to check. Ask the card issuer about a replacement if you see charges you do not recognise.

How many people were affected?

Regulator	What it counts	Number
HHS Office for Civil Rights	Individuals affected	258,920
Indiana attorney general	Total affected	258,920
Texas attorney general	Texans	33,485
Indiana attorney general	Indiana residents	6,608
Massachusetts consumer affairs office	Massachusetts residents	2,329

What is Ridgeway offering?

Twelve months of single-bureau credit monitoring, a credit report and a credit score from Cyberscout, a TransUnion company, with fraud assistance, at no charge.

What Washington's attorney general recorded

Washington's attorney general lists a report from Ridgeway Pharmacy Ltd, received on September 21, 2026, with 3,652 Washington residents affected and a breach date of June 7, 2026. For those residents the record lists names, financial and banking information, dates of birth, health insurance policy or ID numbers and protected health information owned or licensed by a hipaa covered entity as compromised.

What the documents leave open

• Who the website vendor is, and how the unauthorized party got in.
• How long the website was exposed after June 7, 2026.
• Which of Ridgeway's customers' card numbers were taken.

The guide to payment card breach notices compares other letters about card data taken through a website.