CALIFORNIAMalwareHealthcareFinancial ServicesHealthcareRansomwareBusiness Associate (HIPAA)Supply Chain (3P Vendor)Data EncryptedCustomer Data InvolvedRansom DemandedDelayed DiscoveryHealth (basic)Identity (basic)LowResolved

MOLINA HEALTHCARE, INC.

bd_d0b82c76fffb1613 · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 27, 2018

Filed

Feb 22, 2019

To disclose

8 weeks

Affected

895

Confidence

98%

Full breach record for MOLINA HEALTHCARE, INC. →7 incidents on file

Molina Healthcare (CA, Health Plan) reported to HHS on 2019-02-22 a Hacking/IT Incident (ransomware) affecting 895 individuals. On Sept. 23, 2018, Wolverine Solutions Group — a subcontractor of business associate Equian, LLC — suffered a ransomware attack. Molina was notified on Dec. 27, 2018. Affected ePHI included names, addresses, health plan names, dates of service, and provider names across six states. Breached information located on Network Server. Remediation included HIPAA training for the BA and mandatory security enhancements at the subcontractor.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Dec 27, 2018 → Notified Feb 22, 201957d ✓ HHS report on time8 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 95 days

discovery → filing · 8 weeks / 57 days

Sep 23, 2018

Begins

Dec 27, 2018

Discovered

Feb 22, 2019

Filed

vs. sector median

4 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed895 affectedView incident

Name: MOLINA HEALTHCARE, INC.
norm: molina healthcare
Domain: molinahealthcare.com
Industry: Insurance — Health

Name: MOLINA HEALTHCARE, INC.
norm: molina healthcare
Domain: molinahealthcare.com
Industry: Insurance — Health
Industry: Healthcaresource defaultFinancial Servicesllm

Discovered: Dec 27, 2018
Breach occurred: Sep 23, 2018
Undetected for: 95 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 22, 2019
Affected individuals: 895nationwide
Data types: Health (basic)Identity (basic)
HHS breach type: Hacking / IT incident
Where the data lived: Network server
Covered-entity type: Health planBusiness associate involved
Attack vector: Unauthorized Access
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: OCR reviewed applicable BA contracts and obtained assurances that corrective action steps were implemented.
Third party: via Wolverine Solutions Group (subcontractor)

During the incident: Breach notification provided to HHS and affected individuals starting February 22, 2019.
Provided affected individuals with free identity protection for 12 months.
Provided the BA (Equian, LLC) with additional HIPAA training.
Required the BA to ensure its subcontractor (Wolverine Solutions Group) implements systems security enhancements.
Changes made: Additional HIPAA training for business associate.
Systems security enhancements required at subcontractor level.
OCR contract review and corrective action assurances obtained.
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(57 days from discovery to filing)
Compliance flags: HHS report on time · 57dHHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Dec 27, 2018
→ Notified: Feb 22, 2019
57d 60 days HHS report on time
HIPAA
Discovered: Dec 27, 2018
→ Notified: Feb 22, 2019
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Dec 27, 2018 → Notified: Feb 22, 2019	57d	60 days	HHS report on time
HIPAA	Discovered: Dec 27, 2018 → Notified: Feb 22, 2019	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Feb 22, 2019
Raw hash: a78e3970cfb473f3e0da0a37216fc3216c13c263085e4d213280bf29fea78f0a

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.0 KB

Download View at source

Reporting entityMOLINA HEALTHCARE, INC.

Victim entityMOLINA HEALTHCARE, INC.

Incidentdiscovered Dec 27, 2018

Stated responseBreach notification provided to HHS and affected individuals starting February 22, 2019.

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing