Hundreds of thousands of clients’ data lost in cyber attack on Apotheka in Estonia

In February 2024 Apotheka network of pharmacies in Estonia was a victim of a cyber attack. Hundreds of thousands of clients’ data was lost in this attack, as reported by Estonian Central Criminal Police, Prosecutor General’s Office, Data Protection Inspectorate and State Information Systems Department on Thursday, the 4th of April.
Allium UPI, which is a pharmacy and hospital goods distribution company, reported in February that unauthorized access had taken place to the customer card system managed by them, and that personal codes, purchase data and customer contact information had been illegally downloaded from the system.
A criminal procedure was commenced to determine what exactly happened.
According to available information, about 700 000 Apotheka, Apotheka Beauty and PetCity customer card holders’ personal identification numbers, more than 400 000 email addresses, about 60 000 home addresses and about 30 000 phone numbers were illegally downloaded from the Allium UPI database. Information stolen in the attack can also help trace which over-the-counter medicines and other pharmacy products were purchased between 2014 and 2020. This does not apply to prescription medicines, however.
Ago Ambur, head of the Estonian Cyber Bureau of the Central Criminal Police, said that the information currently available to the police shows that the leaked data has not yet been used for criminal purposes, but cybercrime is international and such leaks can be used by other fraudsters.
Prosecutor Vahur Verte says cyber criminals specifically focused on the most sensitive data.
Director General of the Estonian Data Protection Inspectorate Pille Lehis stressed that this case proves once again that corporate data protection is secondary, but it should be more of a priority.
The Head of the Incident Management Division of the State Information Systems Department (CERT EE), Veiko Rāzuke, explained that a cyberattack on a company or institution that has serious consequences often begins with the theft of an employee’s account.
Apotheka, Apotheka Beauty and PetCity are owned by the Estonian pharmaceutical company Magnum, which is controlled by entrepreneur Margus Linnamäe.
Also read: Stevedores: ports need years and a detailed plan to attract new freight
Follow us on Facebook and X!