Tuesday, April 17, 2007

Printer Friendly

Attorney General Abbott Continues Aggressively Enforcing Identity Theft Prevention Law

HOUSTON Texas Attorney General Greg Abbott took legal action Tuesday against CVS Pharmacy for exposing its customers to identity theft. According to court documents filed by the Attorney General, CVS violated a 2005 law requiring businesses to protect any customer records that contain sensitive customer information, including credit and debit card numbers.

Investigators with the Office of the Attorney General (OAG) discovered that a CVS store in Liberty, near Houston, exposed hundreds of its customers to identity theft by failing to properly dispose of records that contained sensitive information. The investigation was launched after reports indicated that bulk customer records were tossed in a dumpster behind the store. Investigators also found several medical prescription forms that included each customer’s name, address, date of birth, issuing physician and the types of medication prescribed. The documents obtained by OAG investigators also contained hundreds of active debit and credit card numbers, complete with expiration dates.

Media links

Sample Documents in CVS Dumpster
(Personal info. dedacted by OAG)

View Video of News Conference
Lawsuit Against CVS
Consumer Complaint Form

"Identity theft is one of the fastest growing crimes in the United States," Attorney General Abbott said. "Texas law protects sensitive personal information in order to prevent this widespread crime. Texans can rest assured that we will continue aggressively cracking down on vendors who jeopardize the confidentiality of their clients' sensitive information."

CVS is accused of violating the 2005 Identity Theft Enforcement and Protection Act, which requires businesses to protect and properly dispose of documents that include clients’ sensitive personal information. Under the law, the OAG has the authority to seek penalties of up to $50,000 per violation.

The Attorney General also charged CVS with violating Chapter 35 of the Business and Commerce Code, which requires businesses to develop retention and disposal procedures for their clients’ personal information. The law provides for civil penalties of up to $500 for each abandoned record.

Attorney General investigators are also working to determine if any exposed data has been used illegally. Consumers who interacted with CVS’ Liberty location should carefully monitor their bank, credit card and any similar statements for evidence of suspicious activity. Customers should also consider obtaining free copies of their credit reports.

Consumers who wish to file a complaint may contact the Office of the Attorney General at (800) 252-8011 or file a complaint online at www.texasattorneygeneral.gov. Consumers can also obtain information on how to detect and prevent identity theft.

Today’s legal action against CVS is the fourth identity theft enforcement action by the Office of the Attorney General in recent weeks. On April 2, Attorney General Abbott took legal action against Fort-Worth based RadioShack Corporation after a Corpus Christi-area store improperly dumped several boxes of receipts that contained customer-identifying information. On March 14, the Attorney General took legal action against Jones Beauty College in Dallas for improperly discarding student financial aid forms with Social Security numbers and other personal information. Also in March, Attorney General Abbott took legal action against On Track Modeling, a North Carolina-based talent agency that abruptly shut down its Grand Prairie office and abandoned more than 60 boxes containing hundreds of confidential client records.