HackingHealthcareFinancial ServicesHealthcareStolen CredentialsCustomer Data InvolvedDelayed DiscoveryPHIIdentity (basic)Health (basic)LowContained

UNITEDHEALTHCARE INSURANCE COMPANY

bd_e9287cbe0a2d6519 · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 29, 2022

Filed

Aug 31, 2023

To disclose

35 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

65%

Full breach record for UNITEDHEALTHCARE INSURANCE COMPANY →33 incidents on file

UnitedHealthcare discovered unauthorized access to its broker portal on December 29, 2022. The incident occurred between December 1, 2022, and January 25, 2023. An unauthorized party accessed member health information, including names, member IDs, and plan details, while attempting to divert funds. Social Security numbers and financial account information were not involved. UnitedHealthcare disabled affected accounts and implemented additional security controls.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 28 days

discovery → filing · 35 weeks / 245 days

Dec 1, 2022

Begins

Dec 29, 2022

Discovered

Aug 31, 2023

Filed

vs. sector median

+22 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Oregon State AGbd_eaecdba95f10cfd72023-08-31Candidate
Washington State AGbd_fd2b45dc3cf0a6d32023-08-31Verified
Massachusetts State AGbd_f92cf02f73c097a72023-08-25 · +6dVerified

Name: UNITEDHEALTHCARE INSURANCE COMPANY
norm: unitedhealthcare insurance
Domain: uhc.com

Name: UNITEDHEALTHCARE INSURANCE COMPANY
norm: unitedhealthcare insurance
Domain: uhc.com
Industry: HealthcarellmFinancial Servicesllm

Discovered: Dec 29, 2022
Breach occurred: Dec 1, 2022 – Jan 25, 2023
Undetected for: 28 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIIdentity (basic)Health (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Disabled the accounts in question to prevent any further access to the network or member information
Implemented additional security controls to prevent this issue from occurring in the future
Notified and continues to work with law enforcement
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 35 weeks(245 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGAug 25 · first

Oregon State AG+6d

Washington State AG+6d

California State AG+6d · this page

Pattern: first filing Aug 25 (MA), last Aug 31 (CA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-572712
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 31, 2023
Raw hash: ca46c0810549bf323cb8ae71a6f3f5e625e23120a2cd04be989988b7cd6261fd

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityUNITEDHEALTHCARE INSURANCE COMPANY

Victim entityUNITEDHEALTHCARE INSURANCE COMPANY

Incidentdiscovered Dec 29, 2022

Stated responseDisabled the accounts in question to prevent any further access to the network or member information

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov