HackingHealthcareFinancial ServicesHealthcareVulnerability ExploitStolen CredentialsZero-DayData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedBusiness Associate (HIPAA)Identity (basic)Government IDPHIHealth (basic)CriticalContained

Premera Blue Cross

bd_e0eaf5d0bdbc73a6 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Feb 10, 2023

Filed

Mar 5, 2023

To disclose

23 days

Affected · nationwide

173,98936,211 in this filing

Confidence

69%

Full breach record for Premera Blue Cross →7 incidents on file

Premera Blue Cross notified the Washington AG of a breach affecting its business associate Brightline, which was impacted by a vulnerability in Fortra's GoAnywhere MFT service. The incident, occurring Jan 28-30, 2023, exposed personal info (names, DOBs, addresses, emails) for 173,989 members, including 36,211 in WA. Fortra exploited a previously unknown vulnerability and used valid accounts to exfiltrate data.

J jump to incidentP pin to compareR raw source

Washington clock✓ WA AG ≤30d23 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 13 days

discovery → filing · 23 days

Jan 28, 2023

Begins

Feb 10, 2023

Discovered

Mar 5, 2023

Filed

vs. sector median

9 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed173,989 affectedView incident

Name: Premera Blue Cross
norm: premera blue cross
Domain: premera.com

Name: Premera Blue Cross
norm: premera blue cross
Domain: premera.com
Industry: HealthcarellmFinancial Servicesllm

Discovered: Feb 10, 2023
Breach occurred: Jan 28, 2023 – Jan 30, 2023
Undetected for: 13 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 27, 2023
Affected individuals: 173,989state + nationwide
Data types: Identity (basic)Government ID
Data elements: NameDate of birthHealth insurance IDSocial Security number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found after the fact
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney GeneralFortra notified law enforcement
Third party: via Fortra LLC
Initial access: exploit_public_facing

During the incident: Fortra shut down affected services
Fortra deleted affected user accounts
Fortra decommissioned and terminated the OS/App instance
Fortra provided new operating environments
Fortra engaged an outside forensic investigator
Fortra is working with law enforcement
Brightline confirmed Fortra deactivated the unauthorized user’s credentials
Brightline disabled the vulnerable java servlet
Brightline rebuilt Brightline’s instance on new infrastructure
Brightline implemented additional security measures including whitelisting for limited IP addresses
Brightline removed all Brightline data from the GoAnywhere MFT SaaS
Premera retained cyber counsel to assist with investigation
Changes made: Implementing additional safeguards
Whitelisting for limited IP addresses to access the previously vulnerable administrative portal
Removal of all Brightline data from the GoAnywhere MFT SaaS
Ongoing measures to reduce data exposure until an alternative file transfer solution is identified and implemented
Enhancing cybersecurity program to further safeguard systems from cyber threats
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 days(23 days from discovery to filing)
Compliance flags: WA AG ≤30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA20143.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 5, 2023
Raw hash: b22f3a44c1b8ba8b4b712c0429753a54abcc8893573b98c1c9ebb71896a16084

Reporting entityPremera Blue Cross

Victim entityPremera Blue Cross

Incidentdiscovered Feb 10, 2023

Stated responseFortra shut down affected services

ComplianceWA AG ≤30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com