AccidentalHealthcareFinancial ServicesHealthcareMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDPHIMediumResolved

PacificSource Health Plans

bd_df318c7163d10bcb · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 13, 2018

Filed

Aug 28, 2018

To disclose

7 weeks

Affected

1state residents only

Confidence

66%

PacificSource Health Plans disclosed personal health information (names, birth dates, SSNs, addresses) to an unintended member via the InTouch for Members website. Incident discovered July 13, 2018. No malicious use indicated. Affected individuals notified August 28, 2018.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 7 weeks / 46 days

Jul 13, 2018

Discovered

Aug 28, 2018

Filed

vs. sector median

6 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: PacificSource Health Plans
norm: pacificsource health plans
Domain: pacificsource.com

Name: PacificSource Health Plans
norm: pacificsource health plans
Domain: pacificsource.com
Industry: HealthcarellmFinancial Servicesllm

Discovered: Jul 13, 2018
Materiality determined: —
Notification sent: Aug 28, 2018
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDPHI
Attack vector: Misconfiguration
MITRE ATT&CK: T1074 Data Staged
Regulator citations: Reporting this disclosure to all federal and state required agencies

During the incident: Notifying every person who might be affected
Extending efforts to prevent unauthorized access
Providing fraud alert guidance
Providing credit report guidance
Establishing a hotline for assistance
Changes made: Extending efforts to prevent unauthorized access
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(46 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/PacificSource-Health-Plans.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 28, 2018
Raw hash: 534e73ce3346f981214557929b63f1f28d5f8276c34af28bb0e7488e1823ca4e

Reporting entityPacificSource Health Plans

Victim entityPacificSource Health Plans

Incidentdiscovered Jul 13, 2018

Stated responseNotifying every person who might be affected

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov