Last week, Walmart Canada, Rite-Aid, CVS, and Sam’s Club were among the retailers to suspend their online photo operations due to a possible data breach of third-party photo service provider PNI Digital (a Staples subsidiary). This is the latest cyber incident to affect the retail industry, which has witnessed a number of high-profile breaches involving third-party vendors in recent years.
Like most businesses, major retailers have long relied on third parties to provide key business services. In fact, years before cyber attacks against third parties became prevalent, the retail industry began developing sophisticated third-party risk management programs to protect their data. One landmark case that changed retailer perspectives on third-party risk management was the settlement between CVS Caremark and the Federal Trade Commission in 2009.
From Physical Security to Cybersecurity
In 2009, the FTC filed a complaint against CVS Caremark following reports that some of its pharmacies were throwing trash into open dumpsters. This trash allegedly contained pill bottles with patient information, addresses, physician names, and medical information. It may have also contained computer order information, employment applications, payroll information, and other personally identifiable information (PII). The FTC alleged that CVS “failed to implement reasonable and appropriate procedures for handling personal information about customers and employees.”
CVS settled the case with the FTC, which said that it that failed to take proper measures to protect medical and financial data for both its customers and employees, and paid a fine to the Department of Health and Human Services to address allegations that it violated the Health Insurance Portability and Accountability Act (HIPAA).
One of the major issues at hand in the case was the lack of visibility and oversight that CVS had into the third parties that were responsible for handling its sensitive data. The FTC settlement specifically called for CVS to address third-party risk through “the development and use of reasonable steps to select and retain service providers capable of appropriately safeguarding personal information they receive from respondent, and requiring service providers by contract to implement and maintain appropriate safeguards.”
At the time, the company had 6,300 retail locations; information on tens of millions of employees and customers could have been mishandled. Developing a plan to secure that sensitive data would present one of the great challenges in vendor risk management. Recognizing the imperative, CVS created a strong vendor risk management program to review “vendors who collect, use, store, process, transmit or destroy Confidential Information on behalf of CVS Caremark.”
