Texas Sues CVS/Caremark for Exposing Customers to Identity Theft

Texas Attorney General Greg Abbott sued CVS/Caremark , after
finding customer records with personal information such as driver license and credit card numbers in the trash behind one of the drugstore chain's Texas stores.

Investigators with the office of the attorney general found the documents in a dumpster behind a CVS store in Liberty, Texas, near Houston, Abbott's office said.

Medical prescription forms with name, address, date of birth, issuing physician and the types of medication prescribed were found, along with hundreds of active debit and credit card numbers with expiration dates, his office said.

The records were found on or about March 19, according to a lawsuit filed with the district court of Liberty County, Texas. The store was either vacant or being vacated, according to a
document filed with the court.

Refund slips with a customer's name, driver's license number and telephone contact were also found, according to the document.

CVS, one of the largest U.S. drugstore chains with about 6,200 stores, was not immediately available to comment.

According to the attorney general, CVS violated a 2005 law that requires businesses to protect customer records with sensitive information, including credit and debit card numbers.

The office of the attorney general said it has the authority to seek penalties of up to $50,000 per violation.

Abbott also charged CVS with violating chapter 35 of the Business and Commerce Code, which requires businesses to develop procedures for retaining and disposing of clients' personal information. The law provides for civil penalties of up to $500 for each abandoned record, he said in a statement.

"Although the dumped business records bore sensitive personal information that could be used to steal the identities of its customers, Defendant failed to shred, erase, or otherwise make the sensitive personal information unreadable or undecipherable. Instead, these business records were placed in a trash dumpster that was readily accessible to the public," the suit states.

The state, as the plaintiff in the case against CVS, requested a trial by jury.

The attorney general said investigators are working to determine if any exposed data was used illegally. He cautioned customers who used the Liberty store to carefully monitor their financial statements for any signs of suspicious activity and said they should consider obtaining free copies of their credit reports.

Texas Attorney General Greg Abbott said that he filed a court action against CVS/Caremark, one of the largest U.S. drugstore chains, after finding customer records including personal information in a trash dumpster behind one of the chain's Texas stores.

According to the attorney general, CVS violated a 2005 law that requires businesses to protect customer records with sensitive information, including credit and debit card numbers.

The office of the attorney general said it has the authority to seek penalties of up to $50,000 per violation.

Abbott also charged CVS with violating chapter 35 of the Business and Commerce Code, which requires businesses to develop procedures for retaining and disposing of clients' personal information. The law provides for civil penalties of up to $500 for each abandoned record, he said in a statement.

Copyright 2009 Reuters. Click for restrictions.