HackingHealthcareFinancial ServicesHealthcareStolen CredentialsMisconfigurationSupply Chain (3P Vendor)Customer Data InvolvedData ExfiltratedIdentity (basic)Government IDPHIHealth (basic)MediumContained

Choice Health

bd_195055c7db804e7e · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 14, 2022

Filed

Sep 8, 2022

To disclose

17 weeks

Affected

639state residents only

Linked

3 filings

Confidence

68%

Choice Health, a third-party provider for Humana, experienced a breach where an unauthorized individual accessed a database exposed to the internet due to a misconfiguration. The incident, discovered on May 14, 2022, affected 639 Washington residents, exposing PII, SSNs, and PHI. Choice Health reconfigured security settings and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d17 weeks discovery → filing

Incident timeline

undetected · 7 days

discovery → filing · 17 weeks / 117 days

May 7, 2022

Begins

May 14, 2022

Discovered

Sep 8, 2022

Filed

vs. sector median

+4 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_5e0ab630db4c85702022-09-21 · +13dVerified
Indiana State AGbd_006726890d9c52a52022-06-08 · +92dCandidate

Name: HUMANA INC.
norm: humana
Domain: humana.com

Name: Choice Health
norm: choice health
Domain: humana.com
Industry: HealthcarellmFinancial Servicesllm

Discovered: May 14, 2022
Breach occurred: May 7, 2022
Undetected for: 7 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 8, 2022
Affected individuals: 639state-resident count only
Data types: Identity (basic)Government IDPHIHealth (basic)
Data elements: NameSocial Security numberDriver's licence numberHealth insurance IDDate of birth
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified the Washington Attorney GeneralNotified the consumer reporting agencies
Initial access: external_remote_services

During the incident: Worked with their third-party service provider to reconfigure the security settings on the database
Confirmed that the database is no longer accessible through the Internet
Sent notification letters to 639 Washington state residents
Notified the consumer reporting agencies
Offered complimentary 24-month membership of Experian IdentityWorks
Changes made: Enhanced data security measures to prevent the occurrence of a similar event
Required multi-factor authentication for all access to database files
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(117 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGJun 8 · first

Washington State AG+92d · this page

Maine State AG+105d

Pattern: first filing Jun 8 (IN), last Sep 21 (ME) — a 105-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13823.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 8, 2022
Raw hash: 6abaff0269c37a0d020ce5a0c6a6d9071a27425eb981727eebc1e69e77f218ee

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityHUMANA INC.

Victim entityChoice Health

Incidentdiscovered May 14, 2022

Stated responseWorked with their third-party service provider to reconfigure the security settings on the database

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com