MalwareHealthcareTechnologyHealthcareRansomwareCapture Stored DataData ExfiltratedData EncryptedSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)PHIHighContained

PurFoods Holdings, LLC

bd_5090c53b8c1f4c24 · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 22, 2023

Filed

Jul 31, 2023

To disclose

23 weeks

Affected

17,660state residents only

Linked

13 filings

Confidence

66%

Full breach record for PurFoods Holdings, LLC →

Humana Inc. reported a privacy incident involving its third-party vendor, PurFoods, LLC DBA Mom’s Meals. Between Jan 16 and Feb 22, 2023, an unauthorized actor encrypted files and potentially exfiltrated data from Mom's Meals systems. The incident impacted 17,660 South Carolina residents, exposing PII, PHI, and financial data. Mom's Meals engaged the FBI, migrated to Azure, and provided credit monitoring.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due23 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 37 days

discovery → filing · 23 weeks / 159 days

Jan 16, 2023

Begins

Feb 22, 2023

Discovered

Jul 31, 2023

Filed

vs. sector median

+12 wks slower

This filing is one of 13 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

HHS OCRbd_2348d2b3c548f4132023-08-25 · +25dVerified
Massachusetts State AGbd_45869f2bc5c79a752023-08-25 · +25dVerified
Maine State AGbd_5922a07dfc32ec372023-08-25 · +25dVerified
New Hampshire State AGbd_71f79a87b2334fa22023-08-25 · +25dVerified

Show 6 more filings ↓up to 31d gap

Montana State AGbd_c2d1d182956f3f112023-08-25 · +25dVerified
California State AGbd_d13fdb19999e965e2023-08-25 · +25dVerified
Indiana State AGbd_deb31006ed70dde82023-08-25 · +25dVerified
Vermont State AGbd_e470432f0b0b59282023-08-25 · +25dVerified
South Carolina State AGbd_e7c24620c0d2d47c2023-08-25 · +25dVerified
Oregon State AGbd_b19ff7b969be846d2023-08-31 · +31dVerified

Showing first 10 of 12 linked disclosures.

Name: HUMANA INC.
norm: humana
Domain: humana.com

Name: PurFoods Holdings, LLC
norm: purfoods holdings
Also named: PurFoods, LLCdba oflegal entity
Mom’s Mealsdba oftrade name
Industry: HealthcarellmTechnologyllm

Discovered: Feb 22, 2023
Breach occurred: Jan 16, 2023 – Feb 22, 2023
Undetected for: 37 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 1, 2023
Affected individuals: 17,660state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Data elements: Social Security numberDate of birthMedical information
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Federal law enforcement (FBI)

During the incident: Notified the FBI of the event
Migrated all systems and applications to Azure
Contracted with third-party cybersecurity companies to perform internal and external penetration testing
Rebuilt all network servers and storage
Enforced multi-factor authentication across their enterprise
Providing impacted individuals with access to free identity monitoring and restoration services through Kroll
Changes made: Enhancing existing training protocols and other internal procedures that relate to data protection and security
Reviewing existing policies and procedures to identify additional measures and safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 weeks(159 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 10 states

View merged incident ↗

South Carolina State AGJul 31 · first · this page

HHS OCR+25d

Massachusetts State AG+25d

Maine State AG+25d

New Hampshire State AG+25d

Montana State AG+25d

California State AG+25d

Indiana State AG+25d

Vermont State AG+25d

South Carolina State AG+25d

Oregon State AG+31d

Pattern: first filing Jul 31 (SC), last Aug 31 (OR) — a 31-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 12 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Humana.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 31, 2023
Raw hash: 3857262296e84a9708c4375ce77113bab7ede89d4cf79f8f69ac4f28ec1a76fa

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityHUMANA INC.

Victim entityPurFoods Holdings, LLC

Incidentdiscovered Feb 22, 2023

Stated responseNotified the FBI of the event

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov