Computerworld - Drugstore chain CVS Corp. has temporarily disabled a feature on its Web site after concerns were raised that unauthorized persons could improperly obtain customer-purchase records via e-mail.
In a statement, Woonsocket, R.I.-based CVS acknowledged that it has turned off the feature that let registered users of its CVS ExtraCare loyalty cards request copies of their purchase data via e-mail and track purchases made under flexible spending accounts (FSA) set up through their employers.
The problem, said Katherine Albrecht, founder and director of the privacy advocacy group Consumers Against Supermarket Privacy Invasion and Numbering, is that anyone can access a cardholder's purchase records if they have the user's 11-digit account number, ZIP code and the first three letters of his last name.
As part of its ExtraCare FSA records, CVS collects and stores data such as the time and date of purchases, the items bought, store locations, universal product codes and customer names, Albrecht said. "The biggest issue is, why does CVS have all this data on the site in the first place?" she added.
CVS officials didn't respond to several requests for comment. But in its statement, the company said the online feature was designed to provide customers with "easy access to their own purchase information for purposes of filing FSA claims for over-the-counter items."
The information stored on the Web site doesn't include prescription purchases, nor does it include Social Security or credit card numbers, which could be used for identity theft, CVS added.
"The security procedures implemented to protect information ... accessed for FSA-related customer needs have been carefully designed, and we believe [they] are effective," the retailer said in the statement. CVS noted that it has received "absolutely no indication" from any cardholders that information has been improperly accessed.
Nevertheless, CVS said it won't restore the FSA-tracking feature until it has developed "additional security hurdles for accessing this purchase information."
Read more about Privacy in Computerworld's Privacy Topic Center.
- Why Projects Fail CIOs are expected to deliver more projects that transform business, and do so on time, on budget and with limited resources.
- The New Business Case for Video Conferencing: 7 Real-World Benefits Beyond Cost-Savings This whitepaper provides insight into the value of video conferencing in today's business environment, and how organizations are using visual collaboration to find...
- Gartner Magic Quadrant for Client Management Tools The client management tool market is maturing and evolving to adapt to consumerization, desktop virtualization, and an ongoing need to improve efficiency.
- Audit Ready and Asset Optimized: The Solid Promise of an Intelligent Software Asset Management Solution In this paper Frost & Sullivan examines the benefits of enterprise-grade Software Asset Management solutions, and how these solutions serve as the convergence...
- Data Protection and Disaster Recovery with iSCSI and VMware Get this on demand webcast now
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users? All Privacy White Papers | Webcasts