Social EngineeringHealthcareFinancial ServicesHealthcarePhishingData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)PIIIdentity (basic)Government IDHealth (basic)MediumContained

Tufts Health Plan

bd_a560968fa299072b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 1, 2020

Filed

Nov 27, 2020

To disclose

21 weeks

Affected

42state residents only

Linked

3 filings

Confidence

66%

Full breach record for Tufts Health Plan →16 incidents on file

Tufts Health Plan notified the New Hampshire Attorney General of a data security incident involving its business associate, EyeMed Vision Care LLC. An unauthorized individual accessed an EyeMed email mailbox from June 24 to July 1, 2020, and sent phishing emails to contacts in the mailbox. The incident potentially affected 42 New Hampshire residents, exposing names, addresses, dates of birth, SSNs, and some medical information. EyeMed secured the account, engaged forensic investigators, and provided two years of credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 7 days

discovery → filing · 21 weeks / 149 days

Jun 24, 2020

Begins

Jul 1, 2020

Discovered

Nov 27, 2020

Filed

vs. sector median

+10 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_52d402898400845e2020-11-27Verified
HHS OCRbd_5b534d0617b2cc2e2020-11-25 · +2dVerified

Name: Tufts Health Plan
norm: tufts health plan
Domain: tuftshealthplan.com

Name: Tufts Health Plan
norm: tufts health plan
Domain: tuftshealthplan.com
Industry: HealthcarellmFinancial Servicesllm

Discovered: Jul 1, 2020
Breach occurred: Jun 24, 2020 – Jul 1, 2020
Undetected for: 7 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 16, 2020
Affected individuals: 42state-resident count only
Data types: PIIIdentity (basic)Government IDHealth (basic)
Data elements: Social Security numberDate of birthMedical information
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: External
Regulator citations: EyeMed provided preliminary notification of the incident to the U.S. Department of Health and Human Services’ Office for Civil Rights (“OCR”), pursuant to the HIPAA Breach Notification RuleEyeMed provided notification of the incident to your office on September 28, 2020On November 25, 2020, THP separately provided notification of this incident to OCR
Third party: via EyeMed Vision Care LLCbusiness associate
Initial access: phishing_link

During the incident: EyeMed took immediate action to block the unauthorized individual's access to the mailbox and secured the mailbox
EyeMed immediately launched an investigation into the incident and engaged a cybersecurity firm to assist in its efforts
EyeMed provided notification of the incident to your office on September 28, 2020
EyeMed mailed letters to all potentially affected THP members between November 16 and 23, 2020
EyeMed is offering all impacted individuals two years of complimentary credit monitoring and identity theft protection
Changes made: EyeMed made changes to how authorized individuals access its network
EyeMed required immediate complex password changes to all employee accounts
EyeMed is reinforcing and providing additional mandatory security awareness training
THP is taking steps to independently verify that THP member information is protected with enhanced administrative and technical measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(149 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

HHS OCRNov 25 · first

Massachusetts State AG+2d

New Hampshire State AG+2d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/tufts-health-plan-20201127.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 27, 2020
Raw hash: 9175a8d8a57cb0ffff41f158685aba3d18b3db0422703cc83dc3634d231de6af

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityTufts Health Plan

Victim entityTufts Health Plan

Incidentdiscovered Jul 1, 2020

Stated responseEyeMed took immediate action to block the unauthorized individual's access to the mailbox and secured the mailbox

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov