MalwareHealthcareHealthcarePhishingRansomwareData ExfiltratedRansom DemandedTargetedIdentity (basic)Government IDCredentialsEmploymentMediumContained

Magellan Health

bd_ae473065eafe4312 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 11, 2020

Filed

May 11, 2020

To disclose

4 weeks

Affected

823state residents only

Linked

13 filings

Confidence

66%

Full breach record for Magellan Health →6 incidents on file

Magellan Health Inc. disclosed a ransomware attack discovered on April 11, 2020, following a phishing email on April 6. The attacker exfiltrated personal data including names, SSNs, and W-2 details from a corporate server. Magellan engaged Mandiant and notified the FBI. Affected individuals were offered three years of Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 5 days

discovery → filing · 4 weeks / 30 days

Apr 6, 2020

Begins

Apr 11, 2020

Discovered

May 11, 2020

Filed

vs. sector median

7 wks faster

This filing is one of 13 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Oregon State AGbd_5bd5952fe83a40242020-05-11Candidate
California State AGbd_ab19fc861c82e8262020-05-11Verified
Massachusetts State AGbd_bf8c076cce5b21132020-05-11Verified
South Carolina State AGbd_9e737f4798eb5a362020-05-12 · +1dVerified

Show 6 more filings ↓up to 37d gap

New Hampshire State AGbd_52cdccf8ed184c492020-05-18 · +7dVerified by operator
California State AGbd_34de5bda8012b71c2020-06-12 · +32dVerified
HHS OCRbd_8bced8d5ed3979b92020-06-12 · +32dVerified
HHS OCRbd_d5286c2b411200662020-06-12 · +32dVerified by operator
Delaware State AGbd_fb92e6e29105fd362020-06-15 · +35dVerified by operator
New Hampshire State AGbd_c2e0d6a5d0abe09d2020-06-17 · +37dVerified

Showing first 10 of 12 linked disclosures.

Name: Magellan Health
norm: magellan health
Domain: magellanhealth.com

Name: Magellan Health
norm: magellan health
Domain: magellanhealth.com
Industry: Healthcarellm

Discovered: Apr 11, 2020
Breach occurred: Apr 6, 2020
Undetected for: 5 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 12, 2020
Affected individuals: 823state-resident count only
Data types: Identity (basic)Government IDCredentialsEmployment
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1041 Exfiltration Over C2 ChannelT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: Reported the incident to appropriate law enforcement authorities, including the FBI
Initial access: phishing_link

During the incident: Retained Mandiant to conduct a thorough investigation
Reported the incident to law enforcement authorities, including the FBI
Offering a complimentary three-year membership of Experian’s IdentityWorks
Changes made: Implemented additional security protocols designed to protect network, email environment, systems, and personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 9 states

View merged incident ↗

Oregon State AGMay 11 · first

California State AGMay 11 · first

Massachusetts State AGMay 11 · first

Montana State AGMay 11 · first · this page

South Carolina State AG+1d

New Hampshire State AG+7d

California State AG+32d

HHS OCR+32d

Delaware State AG+35d

New Hampshire State AG+37d

Pattern: first filing May 11 (OR), last Jun 17 (NH) — a 37-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 12 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/General-Notice-96.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 11, 2020
Raw hash: 91170a4d2b1f3a73c6ce7c83aa5917c9cb87473d51af5cc4c78a79f87996ed83

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityMagellan Health

Victim entityMagellan Health

Incidentdiscovered Apr 11, 2020

Stated responseRetained Mandiant to conduct a thorough investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov