HackingHealthcareFinancial ServicesHealthcareVulnerability ExploitZero-DayTargetedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)PHIMediumContained

HUMANA INC.

bd_52560034b40b0f2a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 29, 2025

Filed

Mar 27, 2026

To disclose

26 weeks

Affected

2state residents only

Linked

7 records

Confidence

67%

Full breach record for HUMANA INC. →43 incidents on file

Humana Inc. notified the Idaho Attorney General of a security incident impacting 2 Idaho residents. Unauthorized access occurred in August 2025 via a previously unknown Oracle vulnerability. Data exposed included names, SSNs, patient account numbers, and PHI. Notification letters were sent on March 16, 2026. Humana engaged Oracle, notified law enforcement, and provided 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d26 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 59 days

discovery → filing · 26 weeks / 179 days

Aug 1, 2025

Begins

Sep 29, 2025

Discovered

Mar 27, 2026

Filed

vs. sector median

+17 wks slower

This filing is one of 7 records about the same incident.View merged incident

A leak claim by cl0p about this victim was first seen 126 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_8fc2d104203011762025-11-21 · +125dVerified by operator

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_d3125512bb3bdc782026-03-18 · +9dVerified
Indiana State AGbd_cba3ac2c85d342572026-03-16 · +11dCandidate
HHS OCRbd_037b41938bc1baac2026-02-28 · +27dVerified
Illinois State AGbd_8ed01c44f5316bd22026-05-01 · +35dVerified

Show 1 more filing ↓up to 49d gap

HHS OCRbd_1b2396b69d25cc382026-05-15 · +49dVerified

Name: HUMANA INC.
norm: humana
Domain: humana.com

Name: HUMANA INC.
norm: humana
Domain: humana.com
Industry: HealthcarellmFinancial Servicesllm

Discovered: Sep 29, 2025
Breach occurred: Aug 1, 2025
Undetected for: 59 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 16, 2026
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Social Security numberMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: notified law enforcementprovided similar notification to the Director of Consumer Affairs and Business Regulation
Initial access: exploit_public_facing

During the incident: Worked with Oracle to address the vulnerability
Notified law enforcement
Began an investigation
Took steps to contain the incident
Enhance our security safeguards
Providing all impacted individuals with access to 24 months of credit monitoring and identity restoration services through Equifax at no charge
Changes made: Worked with Oracle to address the vulnerability
Enhance our security safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 weeks(179 days from discovery to filing)
Compliance flags: Leak >90d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

HHS OCRFeb 28 · first

Indiana State AG+16d

Massachusetts State AG+18d

Idaho State AG+27d · this page

Illinois State AG+62d

HHS OCR+76d

Pattern: first filing Feb 28 (KY), last May 15 (KY) — a 76-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.ag.idaho.gov/content/uploads/2026/04/2026-03-27-Humana-Inc.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 27, 2026
Raw hash: 016044195cd145eca693f8d9a84b69a842fd2ea72ae6c5ec386bb07734c8c4a4

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Reporting entityHUMANA INC.

Victim entityHUMANA INC.

Incidentdiscovered Sep 29, 2025

Stated responseWorked with Oracle to address the vulnerability

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancewww.ag.idaho.gov