HackingHealthcareFinancial ServicesHealthcareDelayed DiscoveryTargetedIdentity (basic)Government IDFinancial accountHealth (basic)MediumContained

Premera Blue Cross

bd_69d72a8fe88cec39 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 29, 2015

Filed

Mar 27, 2015

To disclose

8 weeks

Affected

Not disclosed

Linked

10 filings

Confidence

64%

Full breach record for Premera Blue Cross →7 incidents on file

Premera Blue Cross suffered a cyberattack with initial access on May 5, 2014, discovered on Jan 29, 2015. HCSC notified NH AG on March 27, 2015, that NH residents were impacted. Data accessed included names, SSNs, DOBs, bank info, and PHI. Premera engaged Mandiant and notified the FBI. No evidence of data removal or misuse was found at the time of notification.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 269 days

discovery → filing · 8 weeks / 57 days

May 5, 2014

Begins

Jan 29, 2015

Discovered

Mar 27, 2015

Filed

vs. sector median

4 wks faster

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

Hawaii State AGbd_13935cd688d3ab102015-03-24 · +3dVerified
New Hampshire State AGbd_bc5a1df54eb15c132015-04-02 · +6dVerified
South Carolina State AGbd_9ec8af423fb684d52015-03-19 · +8dVerified
Massachusetts State AGbd_de2d028bf0408dea2015-03-18 · +9dVerified

Show 5 more filings ↓up to 2009d gap

HHS OCRbd_9a804b5de84dfb072015-03-17 · +10dVerified
California State AGbd_e8e76c27f5c889f62015-03-17 · +10dCandidate
New Hampshire State AGbd_f653fc0c8376c8532015-03-17 · +10dVerified
New Hampshire State AGbd_f240484574e352ba2015-05-04 · +38dVerified
HHS OCR enforcementbd_d2050db6681c56222020-09-25 · +2009dVerified by operator

Name: Health Care Service Corp
norm: health care service
Domain: hcsc.com

Name: Premera Blue Cross
norm: premera blue cross
Domain: premera.com
Industry: HealthcarellmFinancial Servicesllm

Discovered: Jan 29, 2015
Breach occurred: May 5, 2014
Undetected for: 269 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Notified the FBI

During the incident: Notified the FBI and are coordinating with their own investigation into this attack
Worked closely with Mandiant, one of the world’s leading cybersecurity firms, to conduct our investigation and to remove the infection created by the attack on our IT systems
Changes made: Taking additional actions to strengthen and enhance the security of our IT systems moving forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(57 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 6 states

View merged incident ↗

HHS OCRMar 17 · first

California State AGMar 17 · first

New Hampshire State AGMar 17 · first

Massachusetts State AG+1d

South Carolina State AG+2d

Hawaii State AG+7d

New Hampshire State AG+10d · this page

New Hampshire State AG+16d

New Hampshire State AG+48d

HHS OCR enforcement+2019d

Pattern: first filing Mar 17 (WA), last Sep 25 — a 2019-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/health-care-services-20150327.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 27, 2015
Raw hash: d4aab51f4d3db3442e10431c24e3778e4a6f74358597a9c4eaa13e0d471061d1

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityHealth Care Service Corp

Victim entityPremera Blue Cross

Incidentdiscovered Jan 29, 2015

Stated responseNotified the FBI and are coordinating with their own investigation into this attack

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov