MalwareHealthcareFinancial ServicesHealthcareRansomwareVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedEmployee Data InvolvedPHIHealth (basic)Identity (basic)MediumContained

Premera Blue Cross

bd_e4bd8d5eab61bc89 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 3, 2023

Filed

Jul 10, 2023

To disclose

5 weeks

Affected

33,237state residents only

Confidence

68%

Full breach record for Premera Blue Cross →7 incidents on file

Premera Blue Cross notified the Washington AG of a ransomware attack on its business associate, Kern Agency, involving an exploit of MOVEit software. The incident occurred May 31-June 1, 2023, and was discovered June 3, 2023. 33,237 Medicare Advantage members' PHI (names, DOB, member ID, etc.) was exfiltrated. Kern engaged forensic investigators and the FBI. Notifications were sent July 13, 2023.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 3 days

discovery → filing · 5 weeks / 37 days

May 31, 2023

Begins

Jun 3, 2023

Discovered

Jul 10, 2023

Filed

vs. sector median

7 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed33,237 affectedView incident

Name: Premera Blue Cross
norm: premera blue cross
Domain: premera.com

Name: Premera Blue Cross
norm: premera blue cross
Domain: premera.com
Industry: HealthcarellmFinancial Servicesllm

Discovered: Jun 3, 2023
Breach occurred: May 31, 2023 – Jun 1, 2023
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 13, 2023
Affected individuals: 33,237state-resident count only
Data types: PHIHealth (basic)Identity (basic)
Data elements: NameDate of birthHealth insurance ID
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found after the fact
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Regulator citations: Notified Federal Bureau of Investigations (FBI)Notified Washington Attorney General
Third party: via Kern Agency
Initial access: exploit_public_facing

During the incident: Kern notified law enforcement and brought in an outside forensic investigator
Kern responded immediately by bringing new servers online that were created from fresh installations
The MOVEit application was also freshly installed, all patches were applied
Rules were deployed to look for future MOVEit exploitation
KERN has updated their internal procedures to require encryption of all data that contain identifiable information
Premera is sending mailing individual notifications
Making all required Federal and State regulatory notifications
Changes made: Updated internal procedures to require encryption of all data that contain identifiable information as they are transferred
Deployed rules to look for future MOVEit exploitation and other related types of attacks
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(37 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25736.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 10, 2023
Raw hash: 5723e362701107eb97ab7d9e1ced6be6cc556ccdb3c1f0881b151724b6344ce1

Reporting entityPremera Blue Cross

Victim entityPremera Blue Cross

Incidentdiscovered Jun 3, 2023

Stated responseKern notified law enforcement and brought in an outside forensic investigator

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com