HackingHealthcareFinancial ServicesHealthcareStolen CredentialsTargetedIdentity (basic)Health (basic)PHILowContained

UNITEDHEALTHCARE INSURANCE COMPANY

bd_729c8b519441f239 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 22, 2023

Filed

Apr 28, 2023

To disclose

9 weeks

Affected

14state residents only

Linked

2 filings

Confidence

65%

Full breach record for UNITEDHEALTHCARE INSURANCE COMPANY →33 incidents on file

UnitedHealthcare notified Montana residents of a credential stuffing attack on its mobile application occurring Feb 19-25, 2023, discovered Feb 22, 2023. Affected data included names, DOB, addresses, and PHI (member IDs, claims). UHC locked accounts, reset passwords, and offered 2 years of LifeLock identity theft protection.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 3 days

discovery → filing · 9 weeks / 65 days

Feb 19, 2023

Begins

Feb 22, 2023

Discovered

Apr 28, 2023

Filed

vs. sector median

3 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Oregon State AGbd_3c5f9789fd8ef4662023-06-09 · +42dVerified

Name: UNITEDHEALTHCARE INSURANCE COMPANY
norm: unitedhealthcare insurance
Domain: uhc.com

Name: UNITEDHEALTHCARE INSURANCE COMPANY
norm: unitedhealthcare insurance
Domain: uhc.com
Industry: HealthcarellmFinancial Servicesllm

Discovered: Feb 22, 2023
Breach occurred: Feb 19, 2023 – Feb 25, 2023
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 20, 2023
Affected individuals: 14state-resident count only
Data types: Identity (basic)Health (basic)PHI
Attack vector: Phishing
MITRE ATT&CK: T1110 Brute ForceT1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Your portal account was locked to prevent any further access
Initiated a forced password reset
Offering you two years of free “LifeLock® Identity Theft Protection Services”
Changes made: Implemented additional security measures to fortify its network’s security measures and protocols
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(65 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGApr 28 · first · this page

Oregon State AG+42d

Pattern: first filing Apr 28 (MT), last Jun 9 (OR) — a 42-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-240.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 28, 2023
Raw hash: bf086b0f00293b15c22a161077cc792b7332d4e76349d29e23dff145d5b51e05

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityUNITEDHEALTHCARE INSURANCE COMPANY

Victim entityUNITEDHEALTHCARE INSURANCE COMPANY

Incidentdiscovered Feb 22, 2023

Stated responseYour portal account was locked to prevent any further access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov