Texas Attorney General Greg Abbott sued CVS Corp. on Tuesday, alleging pharmacy employees dumped credit card numbers, medical information and other sensitive material from more than 1,000 customers into a garbage container.
The Rhode Island company was accused of failing to protect its customers from identity theft at the store in Liberty, about 45 miles northeast of Houston. The lawsuit alleges employees dumped the records behind a store that apparently was being vacated by CVS (nyse: CVS - news - people ).
CVS did not immediately return a telephone call seeking comment Tuesday.
The records, found March 19, included credit and debit card numbers and prescription forms that had customers' names, addresses, dates of birth and types of medications, Abbott said.
"Our personal information, our medical records are supposed to be protected," said 69-year-old Cora Bechtel, one of the customers whose records were found behind the store. "When it's exposed, it's scary,"
CVS is accused of violating provisions of the 2005 Identity Theft Enforcement and Protection Act, which requires the protection and proper destruction of clients' sensitive personal information. If found guilty, CVS could have to pay up to $50,000 per violation.
Abbott's office also charged the company with violations under Chapter 35 of the Business and Commerce Code, which requires businesses to develop retention and disposal procedures for their clients' personal information. The code provides for civil penalties of up to $500 for each abandoned record.
Abbott said his office is investigating whether this is normal practice for CVS at other Texas stores.
"One of the most serious problems plaguing this country and state (is) identity theft," said Abbott, who earlier this month sued Fort Worth-based RadioShack Corp. (nyse: RSH - news - people ) after customer records were dumped in trash bins near a Corpus Christi store.
Tuesday's lawsuit against CVS was the fourth such action taken against a business since the 2005 law was passed.