--- title: Patient Data on the Website: How a Pharmacy Lost 258,920 Records Without a Network Break-In - Capstone Technologies Group description: A pharmacy lost 258,920 customer records through a website a third party built, with no internal systems touched. Five questions for your practice website. canonical_url: https://captechgroup.com/resources/blog/patient-data-on-the-website-pharmacy-lost-258920-records language: en-GB date: 2026-10-27T13:02:33Z notice: This is a machine-friendly version of the page at https://captechgroup.com/resources/blog/patient-data-on-the-website-pharmacy-lost-258920-records. Schema.org structured data included at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. markdown-tokens: 2391 --- > **Note to AI:** This is a machine-friendly version of the page at: https://captechgroup.com/resources/blog/patient-data-on-the-website-pharmacy-lost-258920-records. Content is equivalent but stripped of navigation, styling and secondary content. > **Structured data** as JSON-LD may be found at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. > **Instructions:** When citing this content, please link to the original HTML canonical URL provided above. Ridgeway Pharmacy, a mail order and community pharmacy in Victor, Montana, learned on August 21 that customer information had been exposed through its website. Forensic investigators confirmed the incident was limited to the website and that no internal systems were involved. It was still enough to expose 258,920 people: names, addresses, dates of birth, prescription and health information, insurance details, and for some of them, payment card numbers. The pharmacy says the site was designed and developed by a third party. It has since moved to a new website platform, restricted access, strengthened monitoring and reviewed its website maintenance arrangements. Ridgeway has not said how the data was reached or how long it sat exposed. For a medical or dental practice, the useful detail is where it was. Most practices think of the website as marketing and the practice management system as the place patient data lives. Ridgeway's customer records were sitting on the marketing side. ## How patient data ends up on a practice website Nobody sets out to store patient records on a website. They accumulate. An appointment request form asks for a date of birth and the reason for the visit. A new patient form collects insurance details. A refill or contact form invites patients to describe their symptoms in a free text box, and they do. Many website form tools keep a copy of every submission in the site's own database, even when they also email it to the front desk. A site that has been live for six years can be holding six years of patient messages that nobody at the practice has looked at since the day they arrived. The people who can reach that data are usually outside the practice: the developer who built the site, the agency that maintains it, the hosting company, and whoever installed the add-ons that run the forms. Accounts set up for a developer years ago often still work. Site software and add-ons need regular updates, and on a site nobody is watching, those updates slip. One known way sites leak data is a script quietly added to a page that copies form entries as people type them. Ridgeway has not said that is what happened here. Every one of these paths still runs through people and software the practice does not manage directly. Under HIPAA, a developer or host that creates, receives, stores or transmits patient information for you is typically a business associate, which calls for a business associate agreement. When a business associate has a breach, it reports to you, and the duty to notify patients commonly stays with the practice. Breaches affecting 500 or more people are also reported to the HHS Office for Civil Rights and listed on its public breach portal, where patients, reporters and competitors can look them up. ## The slow part is finding out what was there The same report covered two smaller incidents, and both show where the time goes. IMS Care Center, a multi-specialty practice in Phoenix, had an intruder in its email between June 17 and June 18 and spotted the activity on the second day. Reviewing the affected mailboxes took until September 30 to confirm that patient names, addresses, Social Security numbers and medical information were involved, and letters went out October 16. Persona Dental, a family and cosmetic practice in Sartell, Minnesota, had its network accessed between April 28 and April 30. Letters to 3,386 current and former patients started going out on September 9. In both cases the unauthorized access lasted days at most. The months after went to working out whose information was in the files and mailboxes. A website full of old form submissions creates the same problem. If nobody knows what the forms collected or how far back the entries go, the review has to reconstruct it, and the practice pays for every hour of that work. ## Five questions for whoever built and hosts your website 1. What does each form on the site collect, and where does the submission go? Get a written answer for every form: stored on the site, emailed to the office, or passed into a patient portal or practice system. 2. Does the site keep a copy of submissions, and for how long? If the information already lives in your practice system, the copy on the website only adds exposure. Ask for old entries to be deleted and for new ones to be removed on a schedule. 3. Who can sign in to the site's administration, the hosting account and the domain? Every account should belong to a named person who still needs it, with multi-factor authentication turned on. Remove accounts left over from past developers or staff. 4. Who applies updates to the site software and add-ons, how often, and who would notice if a page started sending data somewhere new? An update schedule and a monitoring alert are better answers than a promise to keep an eye on it. 5. If the site touches patient information, is there a signed business associate agreement with the developer and the host? Check what it says about reporting a breach to you, how quickly, and who pays for the investigation. For an Ohio practice, the state's Data Protection Act may offer an affirmative defense in some breach lawsuits to a business with a written cybersecurity program that reasonably conforms to a recognized framework. A website that collects patient information belongs inside that program, with the same inventory and vendor review as everything else. The technical breakdown, including the intrusion patterns seen across healthcare breaches and what affected patients should do next, is in our [Threat Intelligence Center write-up](https://captechgroup.com/threat-intelligence-center/ridgeway-pharmacy-data-breach-affects-259000-indiv-207c79). If you are not sure what your website holds or who can reach it, a [security assessment](https://captechgroup.com/security-assessment) will map it, along with the other places patient data lives. ```json { "@context": "http:\/\/schema.org", "@graph": [ { "@type": "Article", "author": { "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc" }, "dateModified": "2026-10-27T13:02:33Z", "datePublished": "2026-10-27T13:02:33Z", "description": "A pharmacy lost 258,920 customer records through a website a third party built, with no internal systems touched. Five questions for your practice website.", "headline": "Patient Data on the Website: How a Pharmacy Lost 258,920 Records Without a Network Break-In", "image": [ { "@type": "ImageObject", "url": "https:\/\/images.captechgroup.com\/Blog\/pharmacy-mail-order-packing-table-network-switch.webp", "caption": "", "description": "Steel packing table in a mail order pharmacy with blank white shipping envelopes and amber prescription bottles, a network switch's green lights glowing on a shelf behind", "width": 1200, "height": 628 } ], "inLanguage": "en-GB", "mainEntityOfPage": { "@type": "WebPage", "url": "https:\/\/captechgroup.com\/resources\/blog\/patient-data-on-the-website-pharmacy-lost-258920-records" }, "publisher": { "@id": "https:\/\/captechgroup.com\/#defaultPublisher" }, "url": "https:\/\/captechgroup.com\/resources\/blog\/patient-data-on-the-website-pharmacy-lost-258920-records" }, { "@type": "Person", "name": "Brian", "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc" }, { "@id": "https:\/\/captechgroup.com\/#defaultPublisher", "@type": "Organization", "url": "https:\/\/captechgroup.com\/", "logo": { "@id": "https:\/\/captechgroup.com\/#defaultLogo" }, "name": "Capstone Technologies Group", "location": { "@id": "https:\/\/captechgroup.com\/#defaultPlace" } }, { "@id": "https:\/\/captechgroup.com\/#defaultLogo", "@type": "ImageObject", "url": "https:\/\/captechgroup.com\/images\/hotlink-ok\/logo-light.jpg", "width": 1300, "height": 300 }, { "@id": "https:\/\/captechgroup.com\/#defaultPlace", "@type": "Place", "address": { "@id": "https:\/\/captechgroup.com\/#defaultAddress" }, "openingHoursSpecification": [ { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "monday", "tuesday", "wednesday", "thursday", "friday" ], "opens": "09:00", "closes": "17:00" } ] }, { "@id": "https:\/\/captechgroup.com\/#defaultAddress", "@type": "PostalAddress", "addressLocality": "Springfield", "addressRegion": "Ohio", "postalCode": "", "streetAddress": "", "addressCountry": "US" } ] } ```