HackingHealthcareFinancial ServicesHealthcareData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDPHIHealth (basic)MediumContained

Premera Blue Cross

bd_bc5a1df54eb15c13 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 29, 2015

Filed

Apr 2, 2015

To disclose

9 weeks

Affected

Not disclosed

Linked

10 filings

Confidence

66%

Full breach record for Premera Blue Cross →7 incidents on file

Weyerhaeuser notified New Hampshire AG of its role in notifying enrollees affected by the Premera Blue Cross breach. Premera detected unauthorized access starting May 2014, discovered on Jan 29, 2015. Data included PII and PHI. Weyerhaeuser is sending letters to enrollees.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 273 days

discovery → filing · 9 weeks / 63 days

May 1, 2014

Begins

Jan 29, 2015

Discovered

Apr 2, 2015

Filed

vs. sector median

3 wks faster

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

New Hampshire State AGbd_69d72a8fe88cec392015-03-27 · +6dVerified
Hawaii State AGbd_13935cd688d3ab102015-03-24 · +9dVerified
South Carolina State AGbd_9ec8af423fb684d52015-03-19 · +14dVerified
Massachusetts State AGbd_de2d028bf0408dea2015-03-18 · +15dVerified

Show 5 more filings ↓up to 2003d gap

HHS OCRbd_9a804b5de84dfb072015-03-17 · +16dVerified
California State AGbd_e8e76c27f5c889f62015-03-17 · +16dCandidate
New Hampshire State AGbd_f653fc0c8376c8532015-03-17 · +16dVerified
New Hampshire State AGbd_f240484574e352ba2015-05-04 · +32dVerified
HHS OCR enforcementbd_d2050db6681c56222020-09-25 · +2003dVerified by operator

Name: Weyerhaeuser Company
norm: weyerhaeuser
Domain: weyerhaeuser.com

Name: Premera Blue Cross
norm: premera blue cross
Domain: premera.com
Industry: HealthcarellmFinancial Servicesllm

Discovered: Jan 29, 2015
Breach occurred: May 1, 2014
Undetected for: 273 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 18, 2015
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDPHIHealth (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial

During the incident: Providing letters to enrollees to make sure they are notified
Providing additional information to protect themselves from fraudulent activities
Changes made: Cleansed its IT systems
Taken steps to strengthen and enhance its security going forward
Offering two years of free credit monitoring and identity-theft protection services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(63 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 6 states

View merged incident ↗

HHS OCRMar 17 · first

California State AGMar 17 · first

New Hampshire State AGMar 17 · first

Massachusetts State AG+1d

South Carolina State AG+2d

Hawaii State AG+7d

New Hampshire State AG+10d

New Hampshire State AG+16d · this page

New Hampshire State AG+48d

HHS OCR enforcement+2019d

Pattern: first filing Mar 17 (WA), last Sep 25 — a 2019-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/weyerhaeuser-20150402.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 2, 2015
Raw hash: f6ef98b75bf071378f8856fbea838a9a9aee2c306011a6d2fbfb18dec36dcdf9

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityWeyerhaeuser Company

Victim entityPremera Blue Cross

Incidentdiscovered Jan 29, 2015

Stated responseProviding letters to enrollees to make sure they are notified

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov