AccidentalFinancial ServicesFinanceMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDFinancialMediumResolved

HealthMarkets Insurance Agency

bd_a8fad1093fd23f2a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 12, 2019

Filed

Mar 28, 2019

To disclose

6 weeks

Affected

39state residents only

Linked

2 filings

Confidence

66%

Full breach record for HealthMarkets Insurance Agency →2 incidents on file

HealthMarkets Insurance Agency, Inc. notified the Washington AG of an inadvertent email distribution of sensitive personal information (names, addresses, SSNs, earnings) to four agents. 39 Washington residents were affected. The incident was caused by human error; the company coached employees, requested deletion from recipients, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 6 days

discovery → filing · 6 weeks / 44 days

Feb 6, 2019

Begins

Feb 12, 2019

Discovered

Mar 28, 2019

Filed

vs. sector median

2 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_c0993971347065b12019-03-29 · +1dCandidate

Name: HealthMarkets Insurance Agency
norm: healthmarkets insurance agency
Domain: acaapply.healthmarkets.com

Name: HealthMarkets Insurance Agency
norm: healthmarkets insurance agency
Domain: acaapply.healthmarkets.com
Industry: Financial Servicesllm

Discovered: Feb 12, 2019
Breach occurred: Feb 6, 2019 – Feb 12, 2019
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 4, 2019
Affected individuals: 39state-resident count only
Data types: Identity (basic)Government IDFinancial
Data elements: Social Security number
Attack vector: Misconfiguration
MITRE ATT&CK: T1534 Internal Remote Services
Threat actor: Internal
Regulator citations: Filed Notice of Unauthorized Disclosure of Sensitive Information with Washington Attorney General

During the incident: Performed an investigation to determine the amount and content of information that was released
Interviewed employees and inspected all pertinent electronic records
Coached the employees who sent the email in error
Contacted the third party recipients and requested that the email be deleted
Taken steps to notify the individuals impacted
Offered credit monitoring to those individuals
Changes made: Reviewed practices regarding the internal and external distribution of sensitive personal data
Changes have been made to processes that will prohibit sending an external email with an attachment such as this in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(44 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Washington State AGMar 28 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10652.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 28, 2019
Raw hash: e7b2f468fc1d9846dcd7a1301317a6b23f3ea9ebb98f139f17b6e35ce2a02fb2

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityHealthMarkets Insurance Agency

Victim entityHealthMarkets Insurance Agency

Incidentdiscovered Feb 12, 2019

Stated responsePerformed an investigation to determine the amount and content of information that was released

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com