MalwareHealthcareHealthcareRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)PHIHighContained

Harvard Pilgrim Health Care

bd_9b89b74e0984fc75 · schema v1 · pii pii-v1

Severity

High

Discovered

Apr 17, 2023

Filed

Aug 25, 2023

To disclose

19 weeks

Affected

1,025state residents only

Confidence

71%

Full breach record for Harvard Pilgrim Health Care →14 incidents on file

Harvard Pilgrim Health Care experienced a ransomware attack between March 28 and April 17, 2023, discovered on April 17, 2023. The incident impacted 1,025 Washington residents, exposing PHI, SSNs, and PII. UHC filed this notification on behalf of Harvard Pilgrim on August 25, 2023.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d19 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 20 days

discovery → filing · 19 weeks / 130 days

Mar 28, 2023

Begins

Apr 17, 2023

Discovered

Aug 25, 2023

Filed

vs. sector median

+6 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,025 affectedView incident

Name: UnitedHealthcare
norm: unitedhealthcare
Domain: point32health.org

Name: Harvard Pilgrim Health Care
norm: harvard pilgrim health care
Domain: point32health.org
Industry: Healthcarellm

Discovered: Apr 17, 2023
Breach occurred: Mar 28, 2023 – Apr 17, 2023
Undetected for: 20 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 25, 2023
Affected individuals: 1,025state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: NameSocial Security numberDate of birthHealth insurance IDMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Office of the Attorney General (Washington)Notified other regulatory agencies as required by law

During the incident: Took systems offline to contain the attack
Notified law enforcement
Engaged third-party experts to assist with investigation and remediation
Offering two (2) years of identity theft protection services at no cost
Changes made: Implemented and continues to implement additional cybersecurity safeguards to help minimize the likelihood of this type of event occurring again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(130 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26348.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 25, 2023
Raw hash: e1b5e1da8ab8d2c228b3ca955a0fa6c4e5fc18bbb50337ab3643007c063f3346

Reporting entityUnitedHealthcare

Victim entityHarvard Pilgrim Health Care

Incidentdiscovered Apr 17, 2023

Stated responseTook systems offline to contain the attack

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com