Drugstore chain CVS Corp. has temporarily disabled a feature on its Web site after concerns were raised that unauthorized persons could improperly obtain customer-purchase records via e-mail.
In a statement, Woonsocket, R.I.-based CVS acknowledged that it has turned off the feature that let registered users of its CVS ExtraCare loyalty cards request copies of their purchase data via e-mail and track purchases made under flexible spending accounts (FSA) set up through their employers.
The problem, said Katherine Albrecht, founder and director of the privacy advocacy group Consumers Against Supermarket Privacy Invasion and Numbering, is that anyone can access a cardholder"s purchase records if they have the user"s 11-digit account number, ZIP code and the first three letters of his/her last name.
As part of its ExtraCare FSA records, CVS collects and stores data such as the time and date of purchases, the items bought, store locations, universal product codes and customer names, Albrecht said. "The biggest issue is, why does CVS have all this data on the site in the first place?" she added.
Under review
CVS officials didn"t respond to several requests for comment. But in its statement, the company said the online feature was designed to provide customers with "easy access to their own purchase information for purposes of filing FSA claims for over-the-counter items."
The information stored on the Web site doesn"t include prescription purchases, nor does it include Social Security or credit card numbers, which could be used for identity theft, CVS added.
"The security procedures implemented to protect information ... accessed for FSA-related customer needs have been carefully designed, and we believe [they] are effective," the retailer said in the statement. CVS noted that it has received "absolutely no indication" from any cardholders that information has been improperly accessed.
Nevertheless, CVS said it won"t restore the FSA-tracking feature until it has developed "additional security hurdles for accessing this purchase information."