WASHINGTONMalwareHealthcareFinancial ServicesHealthcarePhishingInfostealerBackdoor / C2Customer Data InvolvedData ExfiltratedDelayed DiscoveryTargetedMulti-Stage ChainHealth (basic)Identity (basic)Government IDFinancial accountCriticalResolved

Premera Blue Cross

bd_9a804b5de84dfb07 · schema v1 · pii pii-v1

Severity

Critical

Financial impact

$6.85M

Discovered

Jan 1, 2015

Filed

Mar 17, 2015

To disclose

11 weeks

Affected

11,000,000

Linked

10 filings

Confidence

96%

Full breach record for Premera Blue Cross →7 incidents on file

Premera Blue Cross (WA/AK) reported to HHS OCR on 2015-03-17 a Hacking/IT Incident affecting 11,000,000 individuals, with breached information located on Network Servers. Attackers used a phishing email in May 2014 to install malware enabling unauthorized access for ~9 months until January 2015 (advanced persistent threat). Exposed PHI included names, addresses, dates of birth, email addresses, SSNs, bank account information, and health plan clinical data for 10.4M+ individuals. PBC settled with OCR for $6.85M — the second-largest HIPAA resolution in OCR history — and agreed to a corrective action plan with two years of monitoring.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS notified11 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 245 days

discovery → filing · 11 weeks / 75 days

May 1, 2014

Begins

Jan 1, 2015

Discovered

Mar 17, 2015

Filed

vs. sector median

2 wks faster

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

California State AGbd_e8e76c27f5c889f62015-03-17Candidate
New Hampshire State AGbd_f653fc0c8376c8532015-03-17Verified
Massachusetts State AGbd_de2d028bf0408dea2015-03-18 · +1dVerified
South Carolina State AGbd_9ec8af423fb684d52015-03-19 · +2dVerified

Show 5 more filings ↓up to 2019d gap

Hawaii State AGbd_13935cd688d3ab102015-03-24 · +7dVerified
New Hampshire State AGbd_69d72a8fe88cec392015-03-27 · +10dVerified
New Hampshire State AGbd_bc5a1df54eb15c132015-04-02 · +16dVerified
New Hampshire State AGbd_f240484574e352ba2015-05-04 · +48dVerified
HHS OCR enforcementbd_d2050db6681c56222020-09-25 · +2019dVerified by operator

Name: Premera Blue Cross
norm: premera blue cross
Domain: premera.com
Industry: Insurance — Health

Name: Premera Blue Cross
norm: premera blue cross
Domain: premera.com
Industry: Insurance — Health
Industry: Healthcaresource defaultFinancial Servicesllm

Discovered: Jan 1, 2015
Breach occurred: May 1, 2014 – Jan 1, 2015
Undetected for: 245 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 11,000,000nationwide
Data types: Health (basic)Identity (basic)Government IDFinancial account
HHS breach type: Hacking / IT incident
Where the data lived: Network server
Covered-entity type: Health plan
Attack vector: Unauthorized Access
MITRE ATT&CK: T1566 PhishingT1566.001 Spearphishing AttachmentT1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: HHS OCR investigation — $6.85 million settlementCorrective Action Plan with two years of monitoring
Initial access: phishing_attachment

During the incident: Filed HHS breach report on 2015-03-17
Agreed to corrective action plan including enterprise-wide risk analysis, risk management, and audit controls
Two years of HHS OCR monitoring
Changes made: Implementation of enterprise-wide risk analysis
Implementation of risk management controls
Implementation of audit controls
Corrective action plan per https://www.hhs.gov/sites/default/files/premera-ra-cap.pdf
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(75 days from discovery to filing)
Compliance flags: HHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Jan 1, 2015
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Jan 1, 2015 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 6 states

View merged incident ↗

California State AGMar 17 · first

New Hampshire State AGMar 17 · first

HHS OCRMar 17 · first · this page

Massachusetts State AG+1d

South Carolina State AG+2d

Hawaii State AG+7d

New Hampshire State AG+10d

New Hampshire State AG+16d

New Hampshire State AG+48d

HHS OCR enforcement+2019d

Pattern: first filing Mar 17 (CA), last Sep 25 — a 2019-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Mar 17, 2015
Raw hash: fe29481693d4efae62a57447192bfd79836496c86999b33fde1107b5dc14a4e4

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html3.0 KB

Download View at source

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityPremera Blue Cross

Victim entityPremera Blue Cross

Incidentdiscovered Jan 1, 2015

Stated responseFiled HHS breach report on 2015-03-17

ComplianceHHS notified

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing