AccidentalHealthcareFinancial ServicesHealthcareMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDPIIMediumResolved

HEALTH NET, INC.

bd_a2246531975f6ffe · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 9, 2009

Filed

Jan 6, 2010

To disclose

17 weeks

Affected

1state residents only

Linked

3 filings

Confidence

66%

Full breach record for HEALTH NET, INC. →8 incidents on file

Health Net, Inc. notified the New Hampshire Attorney General of a misdelivery incident on Jan 6, 2010. On Sept 9, 2009, a report containing members' names, enrollment dates, and Medicare SSNs was mistakenly sent to an insurance agent. One NH resident was affected. Health Net notified the agent, obtained CMS approval for notifications, and sent letters to affected individuals on Jan 4, 2010.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 17 weeks / 119 days

Sep 9, 2009

Discovered

Jan 6, 2010

Filed

vs. sector median

+8 wks slower

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_89d2f9d20f1b37772010-01-06Candidate
Massachusetts State AGbd_35d7deceeb2f4f382010-01-11 · +5dVerified

Name: HEALTH NET, INC.
norm: health net

Name: HEALTH NET, INC.
norm: health net
Industry: HealthcarellmFinancial Servicesllm

Discovered: Sep 9, 2009
Materiality determined: —
Notification sent: Jan 4, 2010
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDPII
Attack vector: Misconfiguration
MITRE ATT&CK: T1530 Data from Cloud Storage Object
Regulator citations: Obtained approval from the Centers for Medicare and Medicaid Services (CMS) of any proposed notification and/or remediation

During the incident: Notified the general agent and requested the destruction of the information
Received written certification from our agent that the report was deleted
Obtained approval from the Centers for Medicare and Medicaid Services (CMS)
Sending notification of this incident to the affected individuals
Providing information about how to obtain a credit report
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(119 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

Massachusetts State AGJan 6 · first

New Hampshire State AGJan 6 · first · this page

Massachusetts State AG+5d

Pattern: first filing Jan 6 (MA), last Jan 11 (MA) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/health-net-20100106.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 6, 2010
Raw hash: f5cc669c3afebadf165b5114db161ff44c8fa46529e0496432fc2e1e59cd2acd

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityHEALTH NET, INC.

Victim entityHEALTH NET, INC.

Incidentdiscovered Sep 9, 2009

Stated responseNotified the general agent and requested the destruction of the information

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov