MalwareHealthcareFinancial ServicesHealthcareRansomwarePhishingData ExfiltratedData EncryptedCustomer Data InvolvedRansom DemandedGovernment IDFinancial accountHealth (basic)Identity (basic)HighContained

Magellan Health

bd_9e737f4798eb5a36 · schema v1 · pii pii-v1

Severity

High

Discovered

Apr 11, 2020

Filed

May 12, 2020

To disclose

4 weeks

Affected

5,416state residents only

Linked

13 filings

Confidence

64%

Full breach record for Magellan Health →6 incidents on file

Magellan Health Inc. disclosed a ransomware attack discovered on April 11, 2020, following a phishing email on April 6. The incident compromised personal information including SSNs, financial data, and health records. Magellan engaged Mandiant for investigation, notified the FBI, and implemented enhanced security protocols. Affected individuals were offered two years of Experian IdentityWorks monitoring.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due4 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 5 days

discovery → filing · 4 weeks / 31 days

Apr 6, 2020

Begins

Apr 11, 2020

Discovered

May 12, 2020

Filed

vs. sector median

7 wks faster

This filing is one of 13 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Oregon State AGbd_5bd5952fe83a40242020-05-11 · +1dCandidate
California State AGbd_ab19fc861c82e8262020-05-11 · +1dVerified
Montana State AGbd_ae473065eafe43122020-05-11 · +1dVerified
Massachusetts State AGbd_bf8c076cce5b21132020-05-11 · +1dVerified

Show 6 more filings ↓up to 36d gap

New Hampshire State AGbd_52cdccf8ed184c492020-05-18 · +6dVerified by operator
California State AGbd_34de5bda8012b71c2020-06-12 · +31dVerified
HHS OCRbd_8bced8d5ed3979b92020-06-12 · +31dVerified
HHS OCRbd_d5286c2b411200662020-06-12 · +31dVerified by operator
Delaware State AGbd_fb92e6e29105fd362020-06-15 · +34dVerified by operator
New Hampshire State AGbd_c2e0d6a5d0abe09d2020-06-17 · +36dVerified

Showing first 10 of 12 linked disclosures.

Name: Magellan Health
norm: magellan health
Domain: magellanhealth.com

Name: Magellan Health
norm: magellan health
Domain: magellanhealth.com
Industry: HealthcarellmFinancial Servicesllm

Discovered: Apr 11, 2020
Breach occurred: Apr 6, 2020
Undetected for: 5 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 15, 2020
Affected individuals: 5,416state-resident count only
Data types: Government IDFinancial accountHealth (basic)Identity (basic)
Data elements: Social Security numberDate of birth
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Regulator citations: Reported the incident to appropriate law enforcement authorities, including the FBI
Initial access: phishing_link

During the incident: Retained Mandiant to conduct a thorough investigation
Reported the incident to appropriate law enforcement authorities, including the FBI
Offered a complimentary two-year membership of Experian’s IdentityWorks
Changes made: Implemented additional security protocols designed to protect network, email environment, systems, and personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(31 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 9 states

View merged incident ↗

Oregon State AGMay 11 · first

California State AGMay 11 · first

Montana State AGMay 11 · first

Massachusetts State AGMay 11 · first

South Carolina State AG+1d · this page

New Hampshire State AG+7d

California State AG+32d

HHS OCR+32d

Delaware State AG+35d

New Hampshire State AG+37d

Pattern: first filing May 11 (OR), last Jun 17 (NH) — a 37-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 12 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/Magellan.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 12, 2020
Raw hash: 8d42bee8745f49d556d5a731150cc464972478713013ca817e20a7c23269a487

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityMagellan Health

Victim entityMagellan Health

Incidentdiscovered Apr 11, 2020

Stated responseRetained Mandiant to conduct a thorough investigation

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov