AccidentalHealthcareTechnologyHealthcareMisconfigurationCustomer Data InvolvedDelayed DiscoveryPIIIdentity (basic)LowContained

Cohere Health

bd_b712e6035cf93a5d · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 15, 2023

Filed

Aug 11, 2023

To disclose

8 weeks

Affected

1state residents only

Linked

2 filings

Confidence

66%

Full breach record for Cohere Health →3 incidents on file

Cohere Health, Inc. notified the New Hampshire Attorney General on August 11, 2023, of a misconfiguration incident where two files containing personal information of Humana insureds were inadvertently set for public access on its cloud provider's platform. Cohere Health became aware of the issue on June 15, 2023. The files were accessible from July 2021 until discovery. One New Hampshire resident was affected. Cohere Health secured the files, launched an investigation, and is offering credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 714 days

discovery → filing · 8 weeks / 57 days

Jul 1, 2021

Begins

Jun 15, 2023

Discovered

Aug 11, 2023

Filed

vs. sector median

4 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_d33fbcd94f0c81532023-08-11Verified

Name: Cohere Health
norm: cohere health

Name: Cohere Health
norm: cohere health
Industry: HealthcarellmTechnologyllm

Discovered: Jun 15, 2023
Breach occurred: Jul 1, 2021
Undetected for: 714 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 11, 2023
Affected individuals: 1state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General

During the incident: Set the files to private
Launched an investigation into the nature and scope of the incident
Offering potentially impacted individuals with complimentary credit monitoring and identity restoration services with Experian
Changes made: Implementing additional safeguards
Re-training employees to better protect against a similar incident from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(57 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGAug 11 · first

New Hampshire State AGAug 11 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/cohere-health-20230811.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 11, 2023
Raw hash: ae80ecaa0dbfcbdaf6b8acd424ff9b00a0b48ad14fb1b07aff32d9a29862d8b8

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityCohere Health

Victim entityCohere Health

Incidentdiscovered Jun 15, 2023

Stated responseSet the files to private

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov