Ads by TechWords

See your link here
Receive the latest technology news and information.
Security
Computerworld Daily News (First Look and Wrap-Up)
Computerworld Blogs Newsletter
The Weekly Top 10
Cloud Computing
View all newsletters




Privacy Policy
 

Privacy Fears Prompt CVS To Turn Off Online Service

June 27, 2005 12:00 PM ET

Computerworld - Drugstore chain CVS Corp. has temporarily disabled a feature on its Web site after concerns were raised that unauthorized persons could improperly obtain customer-purchase records via e-mail.
In a statement, Woonsocket, R.I.-based CVS acknowledged that it has turned off the feature that let registered users of its CVS ExtraCare loyalty cards request copies of their purchase data via e-mail and track purchases made under flexible spending accounts (FSA) set up through their employers.
The problem, said Katherine Albrecht, founder and director of the privacy advocacy group Consumers Against Supermarket Privacy Invasion and Numbering, is that anyone can access a cardholder's purchase records if they have the user's 11-digit account number, ZIP code and the first three letters of his last name.
As part of its ExtraCare FSA records, CVS collects and stores data such as the time and date of purchases, the items bought, store locations, universal product codes and customer names, Albrecht said. "The biggest issue is, why does CVS have all this data on the site in the first place?" she added.
Under Review
CVS officials didn't respond to several requests for comment. But in its statement, the company said the online feature was designed to provide customers with "easy access to their own purchase information for purposes of filing FSA claims for over-the-counter items."
The information stored on the Web site doesn't include prescription purchases, nor does it include Social Security or credit card numbers, which could be used for identity theft, CVS added.
"The security procedures implemented to protect information ... accessed for FSA-related customer needs have been carefully designed, and we believe [they] are effective," the retailer said in the statement. CVS noted that it has received "absolutely no indication" from any cardholders that information has been improperly accessed.
Nevertheless, CVS said it won't restore the FSA-tracking feature until it has developed "additional security hurdles for accessing this purchase information."



Jump to comments

Privacy

Additional Resources

Xerox
By using solid ink technology only from Xerox, you could save up to 65% by printing color for the cost of black and white. Enter for a chance to WIN a PhaserTM 8860 network color printer!
Microsoft
Save time and mitigate security risk. Deploy it now.
Sybase
In this white paper, IDC analyzes the role of next-generation mobile enterprise platforms as organizations seek a more strategic deployment of mobile solutions.

Learn the important issues you must consider before starting your next mobility initiative. Get your mobility white paper from IDC now, compliments of Sybase.

White Papers & Webcasts

Managing Secure File Transfer to Save Time, Money and IT Resources
Learn how companies are using innovative technology to overcome these challenges and improve user productivity by offloading e-mail attachments and replacing FTP with...

Can Heuristic Technology Help Your Company Fight Viruses?
What is Heuristic Technology and how can it help safeguard your business against viruses? Learn more.  

Security Convergence Equals Network Security Cost Savings
Listen to IBM Internet Security Systems' take on network security convergence.

Why Email Must Operate 24/7 and How to Make This Happen
Learn how to avoid an email outage by implementing a hosted email continuity solution.  

Disaster Recovery 2008: Reduced Costs and Improved Performance
How long can your Enterprise afford to be without your data? With an accelerated disaster recovery program, you never have to answer this...