Social EngineeringHealthcareFinancial ServicesHealthcarePhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedTargetedIdentity (basic)Government IDHealth (basic)PHIMediumContained

Magellan Rx Management

bd_6954687b8e38ee45 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 5, 2019

Filed

Nov 27, 2019

To disclose

21 weeks

Affected

1state residents only

Linked

2 filings

Confidence

66%

Full breach record for Magellan Rx Management →4 incidents on file

Magellan Rx Management, a subsidiary of Magellan Health, Inc., notified the NH Attorney General of a phishing incident affecting employee email accounts. Unauthorized access occurred starting May 28, 2019, discovered July 5, 2019. One NH resident's PHI and SSN were potentially exposed. Remediation included securing accounts, enhanced email security, staff training, and offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 38 days

discovery → filing · 21 weeks / 145 days

May 28, 2019

Begins

Jul 5, 2019

Discovered

Nov 27, 2019

Filed

vs. sector median

+10 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_54938097868232672019-11-27Verified

Name: Magellan Health
norm: magellan health
Domain: magellanhealth.com

Name: Magellan Rx Management
norm: magellan rx management
Industry: HealthcarellmFinancial Servicesllm

Discovered: Jul 5, 2019
Breach occurred: May 28, 2019
Undetected for: 38 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 25, 2019
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Social Security numberMedical information
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: phishing_link

During the incident: Magellan's Information Security team immediately took steps to protect the employee's email account
Began a review to determine if any other Magellan employees' email accounts were impacted
Accounts were immediately secured
Implemented enhanced protective measures related to email account log-ins and authentications
Providing additional information for our staff about password strength, security, and usage
Education regarding phishing scams in our annual trainings
Offering identity theft protection services through ID Experts
Changes made: Implemented enhanced protective measures related to email account log-ins and authentications
Providing additional information for our staff about password strength, security, and usage
Education regarding phishing scams in our annual trainings
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(145 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGNov 27 · first

New Hampshire State AGNov 27 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/magellan-health-20191127.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 27, 2019
Raw hash: a2881be4230696ce074dd1d430fd3f54505e095fb9eae6795f81538f7cc40908

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMagellan Health

Victim entityMagellan Rx Management

Incidentdiscovered Jul 5, 2019

Stated responseMagellan's Information Security team immediately took steps to protect the employee's email account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov