The Canadian online pharmacy PlanetDrugsDirect is notifying customers of a data breach that exposed both payment and personal health insurance.

In an email obtained by Bleeping Computer the bargain online retailer said exposed data could include name, address, email, phone number, medical information (including prescription) along with payment card data. The company does not believe passwords or usernames were involved.

No details on the number of people affected or the methodology used by the threat actors was released and PlanetDrugsDirect said the investigation is continuing.