HackingHealthcareFinancial ServicesHealthcareVulnerability ExploitZero-DayTargetedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)PHIMediumContained

HUMANA INC.

bd_52560034b40b0f2a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 29, 2025

Filed

Mar 27, 2026

To disclose

26 weeks

Affected

2state residents only

Linked

16 filings

Confidence

67%

Full breach record for HUMANA INC. →40 incidents on file

Humana Inc. notified the Idaho Attorney General of a security incident impacting 2 Idaho residents. Unauthorized access occurred in August 2025 via a previously unknown Oracle vulnerability. Data exposed included names, SSNs, patient account numbers, and PHI. Notification letters were sent on March 16, 2026. Humana engaged Oracle, notified law enforcement, and provided 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d26 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 59 days

discovery → filing · 26 weeks / 179 days

Aug 1, 2025

Begins

Sep 29, 2025

Discovered

Mar 27, 2026

Filed

vs. sector median

+13 wks slower

This filing is one of 16 about the same incident.View merged incident

A leak claim by cl0p about this victim predates this filing by 125 days.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Massachusetts State AGbd_d3125512bb3bdc782026-03-18 · +9dVerified
Texas State AGbd_22aeccc5358a90112026-04-24 · +28dVerified by operator
Idaho State AGbd_9d83c93a948631422026-04-30 · +34dVerified by operator
Illinois State AGbd_7c6eea2e34a068c22026-05-01 · +35dVerified

Show 6 more filings ↓up to 83d gap

Illinois State AGbd_8ed01c44f5316bd22026-05-01 · +35dVerified
HHS OCRbd_1b2396b69d25cc382026-05-15 · +49dVerified
Nebraska State AGbd_960ec039543338a62026-06-01 · +66dVerified
New Hampshire State AGbd_340755f98cffa7042026-06-12 · +77dVerified by operator
Massachusetts State AGbd_60905841e9eb00ec2026-06-12 · +77dVerified by operator
Texas State AGbd_bb1cc89a278c171c2026-06-18 · +83dVerified by operator

Showing first 10 of 15 linked disclosures.

Name: HUMANA INC.
norm: humana
Domain: humana.com

Name: HUMANA INC.
norm: humana
Domain: humana.com
Industry: HealthcarellmFinancial Servicesllm

Discovered: Sep 29, 2025
Breach occurred: Aug 1, 2025
Undetected for: 59 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 16, 2026
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Social Security numberMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: notified law enforcementprovided similar notification to the Director of Consumer Affairs and Business Regulation
Initial access: exploit_public_facing

During the incident: Worked with Oracle to address the vulnerability
Notified law enforcement
Began an investigation
Took steps to contain the incident
Enhance our security safeguards
Providing all impacted individuals with access to 24 months of credit monitoring and identity restoration services through Equifax at no charge
Changes made: Worked with Oracle to address the vulnerability
Enhance our security safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 weeks(179 days from discovery to filing)
Compliance flags: Leak >90d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 7 states

View merged incident ↗

Massachusetts State AGMar 18 · first

Idaho State AG+9d · this page

Texas State AG+37d

Idaho State AG+43d

Illinois State AG+44d

HHS OCR+58d

Nebraska State AG+75d

New Hampshire State AG+86d

Massachusetts State AG+86d

Texas State AG+92d

Pattern: first filing Mar 18 (MA), last Jun 18 (TX) — a 92-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 15 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.ag.idaho.gov/content/uploads/2026/04/2026-03-27-Humana-Inc.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 27, 2026
Raw hash: 016044195cd145eca693f8d9a84b69a842fd2ea72ae6c5ec386bb07734c8c4a4

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityHUMANA INC.

Victim entityHUMANA INC.

Incidentdiscovered Sep 29, 2025

Stated responseWorked with Oracle to address the vulnerability

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancewww.ag.idaho.gov