Ravkoo, an internet-based U.S. pharmaceutical service, disclosed a data breach after the company’s AWS-hosted cloud prescription portal was involved in a security incident that may have led to access to personal information and health.

“Ravkoo uses AWS cloud services for the online hosting of its prescription portal. On September 27, 2021, Ravkoo detected that this portal was the target of a cybersecurity attack, ”the pharmacy said in data breach notification letters sent to 105,000 customers affected January 3.

“An unauthorized third party attempted to infiltrate the portal. On October 27, 2021, Ravkoo’s reactive forensic investigation revealed that some prescribing and health information may have been compromised.”

The company also said it could not find any evidence that customers’ social security numbers had been accessed during the incident, adding that it was not storing SSN data on the affected prescribing portal.

Alpesh Patel, CEO of online pharmacy, said in a public notification on Ravkoo website that the incident was reported to the FBI. The company is participating in the federal law enforcement agency’s ongoing investigation into the case.

Ravkoo has yet to find any evidence that any of the information exposed during the incident was misused, as it has not received any reports of impersonation related to this data breach since the 27th. September, date of the incident.

Data subjects also receive one year of free online identity monitoring service from Kroll Information Assurance to enable them to resolve identity theft issues related to this data breach.

Seemingly “hilariously easy” to hack

Details of the incident that Ravkoo shared with several state attorney general offices and affected clients align with a interception report right after the incident, saying that an anonymous hacker Ravkoo was “hilariously easy” to hack.

The alleged hacker claims being able to access Ravkoo’s systems using a hidden admin panel that any user could have used to view all data.

“The hacker also provided records of 340,000 prescriptions that Ravkoo filled between November 3, 2020 and September 11, 2021, at an estimated cost of $ 8.5 million in drugs,” revealed Micah Lee of The Intercept.

A Ravkoo spokesperson did not respond to a request for comment when BleepingComputer contacted earlier today for further details regarding the data breach.