MalwareHealthcareHealthcareRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedSupply Chain (3P Vendor)PHIHealth (basic)Identity (basic)LowContained

ANTHEM HEALTH PLANS OF NEW HAMPSHIRE, INC.

bd_2701bb55c4eda4c6 · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 23, 2021

Filed

Sep 26, 2022

To disclose

40 weeks

Affected · nationwide

261 in this filing

Confidence

66%

Full breach record for ANTHEM HEALTH PLANS OF NEW HAMPSHIRE, INC. →

Anthem Health Plans of New Hampshire, Inc. (a subsidiary of Elevance Health) notified the NH Attorney General of a ransomware attack on its vendor, RRD. The incident occurred between Nov 29 and Dec 23, 2021. The attack impacted PHI and PII of 26 individuals (1 NH resident). Notifications were sent on Sept 27, 2022.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 24 days

discovery → filing · 40 weeks / 277 days

Nov 29, 2021

Begins

Dec 23, 2021

Discovered

Sep 26, 2022

Filed

vs. sector median

+29 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed26 affectedView incident

Name: Elevance Health, Inc.
norm: elevance health

Name: ANTHEM HEALTH PLANS OF NEW HAMPSHIRE, INC.
norm: anthem health plans of new hampshire
Industry: Healthcarellm

Discovered: Dec 23, 2021
Breach occurred: Nov 29, 2021 – Dec 23, 2021
Undetected for: 24 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 27, 2022
Affected individuals: 26state + nationwide
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial

During the incident: Initiated its incident response plan
Shutting down its internal network access
Engaged third-party e-discovery vendor
Investigated, remediated, and restored the affected systems
Ensuring all backup data was clean
Offering a complimentary one-year membership of Experian’s IdentityWorks
Changes made: Offering a complimentary one-year membership of Experian’s IdentityWorks
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 40 weeks(277 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/elevance-health-20220926.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 26, 2022
Raw hash: 922fb5717e2e8ff7bc99bbaee2dca2eeb9fb1182d80b723e3e41cceb7162ac03

Reporting entityElevance Health, Inc.

Victim entityANTHEM HEALTH PLANS OF NEW HAMPSHIRE, INC.

Incidentdiscovered Dec 23, 2021

Stated responseInitiated its incident response plan

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov