US online pharmacy Ravkoo links data breach to AWS portal incident

Ravkoo, a US Internet-based pharmacy service, has disclosed a data breach after the company’s AWS hosted cloud prescription portal was involved in a security incident that may have led to personal and health information being accessed.

“Ravkoo utilizes AWS cloud services for online hosting of its prescription portal. On September 27, 2021, Ravkoo detected that this portal was the target of a cybersecurity attack,” the pharmacy said in data breach notification letters sent to 105,000 affected customers on January 3.

“An unauthorized third party attempted to infiltrate the portal. On October 27, 2021, Ravkoo’s responsive forensic investigation revealed that certain prescription and health information could have been compromised.”

The company also said that it found no evidence that customers’ Social Security Numbers were accessed during the incident, adding that it does not store SSN data on the affected prescription portal.

Alpesh Patel, the online pharmacy’s CEO, said in a public notification on Ravkoo’s site that the incident was reported to the FBI. The company is assisting the federal law enforcement agency’s ongoing investigation into the matter.

Ravkoo is yet to find any evidence that any of the information exposed in the incident has been misused since it hasn’t received reports of identity theft linked to this data breach since September 27, the date of the incident.

Affected individuals are also provided with one year of free online identity monitoring service from Kroll Information Assurance to allow them to resolve identity theft issues linked to this data breach.

Reportedly “hilariously easy” to hack

The details of the incident Ravkoo shared with Attorney Generals’ offices from multiple states and affected customers line up with a report from The Intercept right after the incident took place saying that an anonymous hacker that Ravkoo was “hilariously easy” to breach.

The alleged hacker claimed to have been able to gain access to Ravkoo’s systems using a hidden admin panel any user could have used to view all data.

“The hacker also provided records of 340,000 prescriptions that Ravkoo has filled between November 3, 2020, and September 11, 2021 — amounting to an estimated $8.5 million in drug costs,” The Intercept’s Micah Lee revealed.

A Ravkoo spokesperson didn’t reply to a request for comment when BleepingComputer reached out earlier today for additional details regarding the data breach.