MisuseHealthcareFinancial ServicesHealthcarePrivilege AbuseEmployee Data InvolvedTargetedIdentity (basic)Government IDMediumActive

AmeriHealth Caritas Family of Companies

bd_c9326e005426c6b9 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 15, 2019

Filed

Jan 29, 2020

To disclose

11 weeks

Affected

11state residents only

Linked

3 filings

Confidence

66%

AmeriHealth Caritas Family of Companies notified the NH AG of a breach involving a terminated employee who downloaded provider data (names, SSNs, DOBs) to a personal hard drive. 11 NH providers affected. Law enforcement notified; credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 11 weeks / 75 days

Nov 15, 2019

Discovered

Jan 29, 2020

Filed

vs. sector median

1 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

South Carolina State AGbd_40c96021babb9d952020-01-20 · +9dVerified
Delaware State AGbd_c65eab022bc01f382019-11-14 · +76dCandidate

Name: Morgan Lewis
norm: morgan lewis
Domain: morgan-motor.com

Name: AmeriHealth Caritas Family of Companies
norm: amerihealth caritas
Industry: HealthcarellmFinancial Servicesllm

Discovered: Nov 15, 2019
Materiality determined: —
Notification sent: Jan 24, 2020
Affected individuals: 11state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: insider_action

During the incident: Notified law enforcement
Offering two-year subscriptions to Experian IdentityWorks' credit monitoring and identity theft protection services
Changes made: Looking into changes to controls and procedures to reduce the risk of similar events occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(75 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Delaware State AGNov 14 · first

South Carolina State AG+67d

New Hampshire State AG+76d · this page

Pattern: first filing Nov 14 (DE), last Jan 29 (NH) — a 76-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/amerihealth-cartas-family-20200129.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 29, 2020
Raw hash: 40a70518f234090fd8a7e49cf5ada45f109885aed0fa7eff813c48eb832bd5dd

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMorgan Lewis

Victim entityAmeriHealth Caritas Family of Companies

Incidentdiscovered Nov 15, 2019

Stated responseNotified law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov