HackingHealthcareFinancial ServicesHealthcareDelayed DiscoveryData ExfiltratedTargetedIdentity (basic)Government IDFinancial accountHealth (basic)MediumContained

Premera Blue Cross

bd_9ec8af423fb684d5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 29, 2015

Filed

Mar 19, 2015

To disclose

7 weeks

Affected

Not disclosed

Linked

10 filings

Confidence

64%

Full breach record for Premera Blue Cross →7 incidents on file

Premera Blue Cross notified members of a sophisticated cyberattack where attackers gained unauthorized access to IT systems starting May 5, 2014. Discovered Jan 29, 2015, the breach may have exposed names, SSNs, DOBs, bank info, and clinical data. Premera engaged Mandiant, notified the FBI, and offered two years of credit monitoring. No evidence of data removal or misuse was found at the time of notification.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 269 days

discovery → filing · 7 weeks / 49 days

May 5, 2014

Begins

Jan 29, 2015

Discovered

Mar 19, 2015

Filed

vs. sector median

5 wks faster

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

Massachusetts State AGbd_de2d028bf0408dea2015-03-18 · +1dVerified
HHS OCRbd_9a804b5de84dfb072015-03-17 · +2dVerified
California State AGbd_e8e76c27f5c889f62015-03-17 · +2dCandidate
New Hampshire State AGbd_f653fc0c8376c8532015-03-17 · +2dVerified

Show 5 more filings ↓up to 2017d gap

Hawaii State AGbd_13935cd688d3ab102015-03-24 · +5dVerified
New Hampshire State AGbd_69d72a8fe88cec392015-03-27 · +8dVerified
New Hampshire State AGbd_bc5a1df54eb15c132015-04-02 · +14dVerified
New Hampshire State AGbd_f240484574e352ba2015-05-04 · +46dVerified
HHS OCR enforcementbd_d2050db6681c56222020-09-25 · +2017dVerified by operator

Name: Premera Blue Cross
norm: premera blue cross
Domain: premera.com

Name: Premera Blue Cross
norm: premera blue cross
Domain: premera.com
Industry: HealthcarellmFinancial Servicesllm

Discovered: Jan 29, 2015
Breach occurred: May 5, 2014
Undetected for: 269 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 18, 2015
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Data elements: Date of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified the FBI
Initial access: exploit_public_facing

During the incident: Notified the FBI and are coordinating with their own investigation into this attack
Worked closely with Mandiant to conduct our investigation and to remove the infection created by the attack on our IT systems
Providing protection and assistance to those affected by this cyberattack, including two years of free credit monitoring and identity theft protection services
Providing you a free, two-year membership in Experian’s ProtectMyIDe Alert
Cleansed its IT system of issues raised by this cyberattack
Taking additional actions to strengthen and enhance the security of our IT systems moving forward
Changes made: Cleansed its IT system of issues raised by this cyberattack
Taking additional actions to strengthen and enhance the security of our IT systems moving forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(49 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 6 states

View merged incident ↗

HHS OCRMar 17 · first

California State AGMar 17 · first

New Hampshire State AGMar 17 · first

Massachusetts State AG+1d

South Carolina State AG+2d · this page

Hawaii State AG+7d

New Hampshire State AG+10d

New Hampshire State AG+16d

New Hampshire State AG+48d

HHS OCR enforcement+2019d

Pattern: first filing Mar 17 (WA), last Sep 25 — a 2019-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/PremeraBlueCross.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 19, 2015
Raw hash: ee7e2688c12fb035c9dc9da25d275bbdb8899e85606f0b9e0997e21556bd4349

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityPremera Blue Cross

Victim entityPremera Blue Cross

Incidentdiscovered Jan 29, 2015

Stated responseNotified the FBI and are coordinating with their own investigation into this attack

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov