AccidentalHealthcareProfessional ServicesHealthcareMisconfigurationCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)MediumResolved

Keenan & Associates

bd_412f5c0756271b19 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 9, 2015

Filed

Dec 1, 2015

To disclose

8 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for Keenan & Associates →4 incidents on file

Keenan & Associates, a third-party health insurance administrator, discovered on October 9, 2015, that documents containing employee and dependent information (names, addresses, phone numbers, birth dates, plan identifiers, and some SSNs) were potentially searchable on the Internet due to a vendor's misconfiguration of security settings on a portal. The documents did not contain medical claims or diagnostic codes. Keenan reconfigured the portal, engaged Kroll for two years of identity monitoring, and instructed vendors to stop using the responsible software tool.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 8 weeks / 53 days

Oct 9, 2015

Begins

Oct 9, 2015

Discovered

Dec 1, 2015

Filed

vs. sector median

3 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

HHS OCRbd_01a0a9b2ade957462015-12-01Verified
Massachusetts State AGbd_8c9f0daebe5177722015-12-02 · +1dVerified

Name: Keenan & Associates
norm: keenan associates

Name: Keenan & Associates
norm: keenan associates
Industry: HealthcarellmProfessional Servicesllm

Discovered: Oct 9, 2015
Breach occurred: Oct 9, 2015
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDHealth (basic)
Attack vector: Misconfiguration
Third party: via Vendor

During the incident: Immediately began an investigation
Reconfigured portal settings to remove documents from Internet searchability
Secured the services of Kroll to provide identity monitoring at no cost for two years
Changes made: Instructing vendors not to use the software tool that caused the incident
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(53 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

HHS OCRDec 1 · first

California State AGDec 1 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-59125
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 1, 2015
Raw hash: ded89485c52bd7c06342abf8b85face0b4962f5b1afd8e94a64ec9ddf32ff3f6

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityKeenan & Associates

Victim entityKeenan & Associates

Incidentdiscovered Oct 9, 2015

Stated responseImmediately began an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov