Estonia issues arrest warrant for Moroccan wanted for major pharmacy data breach

Estonian authorities have launched an international search for a Moroccan citizen suspected in one of the country’s largest data breaches, which exposed sensitive customer data from a popular pharmacy chain.

According to Estonia’s police, 25-year-old Adrar Khalid is suspected of unlawfully accessing a customer card database managed by Allium UPI, the parent company of the Apotheka pharmacy chain, in February 2024.

Investigators believe he logged into the system using administrator credentials, though how he obtained the password remains under investigation. Reemo Salupõld, head of the cybercrime bureau’s investigation team, said there is reason to suspect Khalid intentionally exploited privileged access to download personal data.

Estonia’s Prosecutor General has requested Khalid’s arrest. He has been placed on an international wanted list, and authorities plan to request extradition if he is detained abroad.

According to previous reports, the breach exposed nearly 700,000 personal identification codes, over 400,000 email addresses, nearly 60,000 home addresses and about 30,000 phone numbers. The database also reportedly contained purchase records of over-the-counter medications and pharmacy products dating back to 2014, though it did not include prescription drug data. No misuse of the stolen data has been detected so far, officials said.

The Estonia-based company Allium UPI, which operates in the pharmacy and healthcare product sectors in Estonia, Latvia and Lithuania, disclosed the breach in February, saying its customer loyalty system had been compromised. The company supplies products to pharmacies and hospitals and manages customer programs for Apotheka, Apotheka Beauty and PetCity.