Social EngineeringHealthcareFinancial ServicesHealthcarePhishingStolen CredentialsTargetedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Delta Dental of Illinois

bd_f13df91283edabd5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 1, 2019

Filed

Apr 16, 2019

To disclose

7 weeks

Affected

2state residents only

Linked

5 filings

Confidence

66%

Full breach record for Delta Dental of Illinois →2 incidents on file

Delta Dental of Illinois notified Montana residents of a security incident where an employee's email credentials were obtained via phishing. The attacker accessed the account between Dec 21-28, 2018, potentially exposing member PII including names, DOBs, SSNs, and insurance info. Delta Dental engaged forensic investigators, reset passwords, and offered one year of identity monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 70 days

discovery → filing · 7 weeks / 46 days

Dec 21, 2018

Begins

Mar 1, 2019

Discovered

Apr 16, 2019

Filed

vs. sector median

6 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_258f4aa6c15cd8622019-04-16Verified
HHS OCRbd_d5bbe0a6ab70d39e2019-04-16Verified
HHS OCRbd_ce29f0bcf8c00ae72019-04-17 · +1dVerified
New Hampshire State AGbd_0c762bd4d8decd2b2019-05-06 · +20dVerified

Name: Delta Dental of Illinois
norm: delta dental of illinois
Domain: deltadentalil.com

Name: Delta Dental of Illinois
norm: delta dental of illinois
Domain: deltadentalil.com
Industry: HealthcarellmFinancial Servicesllm

Discovered: Mar 1, 2019
Breach occurred: Dec 21, 2018 – Dec 28, 2018
Undetected for: 70 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: consulted with law enforcement
Initial access: phishing_link

During the incident: Initiating an internal investigation
Retaining an independent forensic investigation firm to assist us in our investigation of and response to this incident
Reset employee account passwords
Implemented additional email security tools
Consulted with law enforcement
Offering one year of complimentary identity protection services from a leading identity monitoring services company
Changes made: Implemented additional email security tools to help prevent this type of incident from reoccurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(46 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Massachusetts State AGApr 16 · first

HHS OCRApr 16 · first

Montana State AGApr 16 · first · this page

HHS OCR+1d

New Hampshire State AG+20d

Pattern: first filing Apr 16 (MA), last May 6 (NH) — a 20-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/CON-DDIL-Individual-Member-Notice-Letter-1-Yr-Protection-FINAL.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 16, 2019
Raw hash: 29f46a6e887000a5a5152d2b553b5da473b9efff43aad6e32685e31f8c80ce82

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityDelta Dental of Illinois

Victim entityDelta Dental of Illinois

Incidentdiscovered Mar 1, 2019

Stated responseInitiating an internal investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov