MalwareHealthcareTechnologyHealthcareRansomwareCapture Stored DataData ExfiltratedData EncryptedSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)PHIHighContained

HUMANA INC.

bd_5090c53b8c1f4c24 · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 22, 2023

Filed

Jul 31, 2023

To disclose

23 weeks

Affected

17,660state residents only

Linked

5 filings

Confidence

66%

Full breach record for HUMANA INC. →43 incidents on file

Humana Inc. reported a privacy incident involving its third-party vendor, PurFoods, LLC DBA Mom’s Meals. Between Jan 16 and Feb 22, 2023, an unauthorized actor encrypted files and potentially exfiltrated data from Mom's Meals systems. The incident impacted 17,660 South Carolina residents, exposing PII, PHI, and financial data. Mom's Meals engaged the FBI, migrated to Azure, and provided credit monitoring.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due23 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 37 days

discovery → filing · 23 weeks / 159 days

Jan 16, 2023

Begins

Feb 22, 2023

Discovered

Jul 31, 2023

Filed

vs. sector median

+14 wks slower

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_07655a2a6e4cc69f2023-07-25 · +6dVerified by operator
Massachusetts State AGbd_12747388e9bb96062023-08-12 · +12dVerified by operator
Delaware State AGbd_e660e2204a7c502e2023-09-22 · +53dVerified by operator
HHS OCRbd_4ffc72f56cdf73a12024-01-22 · +175dVerified

Name: HUMANA INC.
norm: humana
Domain: humana.com

Name: HUMANA INC.
norm: humana
Domain: humana.com
Industry: HealthcarellmTechnologyllm

Discovered: Feb 22, 2023
Breach occurred: Jan 16, 2023 – Feb 22, 2023
Undetected for: 37 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 1, 2023
Affected individuals: 17,660state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Data elements: Social Security numberDate of birthMedical information
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Federal law enforcement (FBI)
Third party: via Purfoods, LLC DBA Mom’s Meals

During the incident: Notified the FBI of the event
Migrated all systems and applications to Azure
Contracted with third-party cybersecurity companies to perform internal and external penetration testing
Rebuilt all network servers and storage
Enforced multi-factor authentication across their enterprise
Providing impacted individuals with access to free identity monitoring and restoration services through Kroll
Changes made: Enhancing existing training protocols and other internal procedures that relate to data protection and security
Reviewing existing policies and procedures to identify additional measures and safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 weeks(159 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Massachusetts State AGJul 25 · first

South Carolina State AG+6d · this page

Massachusetts State AG+18d

Delaware State AG+59d

HHS OCR+181d

Pattern: first filing Jul 25 (MA), last Jan 22 (KY) — a 181-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/Humana.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 31, 2023
Raw hash: 3857262296e84a9708c4375ce77113bab7ede89d4cf79f8f69ac4f28ec1a76fa

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityHUMANA INC.

Victim entityHUMANA INC.

Incidentdiscovered Feb 22, 2023

Stated responseNotified the FBI of the event

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov