MOMultipleHealthcareFinancial ServicesHealthcareMisconfigurationMisdeliveryCustomer Data InvolvedMulti-Stage ChainIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICMediumResolved

UNION SECURITY INSURANCE COMPANY

bd_f4124a562d101179 · schema v1 · pii pii-v1

Full breach record for UNION SECURITY INSURANCE COMPANY →

Union Security Insurance Company (MO), a Health Plan, reported to HHS on 2011-04-08 an Unauthorized Access/Disclosure affecting 935 individuals. Two incidents occurred: (1) On 2011-02-18, a policyholder discovered they could access other policyholders' online accounts (~1,500 affected) exposing names, DOBs, SSNs, and other identifiers due to a website coding flaw. (2) On 2013-05-17, an employee impermissibly emailed a spreadsheet with names and SSNs of ~1,127 group members. Breached information located in: Other. Remediation included disabling/recoding the website, increased vulnerability scans, employee retraining, and a ban on SSNs in customer documents.

HIPAA clock✓ HHS notified7 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed935 affectedView incident

Source provenance

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Apr 8, 2011
Raw hash: cf6a0e7d210ae82e0dab14e2ad0c05290a38417c0859370dc2cb925ef1c0c99d

Source filing

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.2 KB

Download View at source

Reporting entity

Name: UNION SECURITY INSURANCE COMPANY
norm: union security insurance
Industry: Insurance — Health

Victim entity

Name: UNION SECURITY INSURANCE COMPANY
norm: union security insurance
Industry: Insurance — Health
Industry: Healthcaresource defaultFinancial Servicesllm

Incident

Discovered: Feb 18, 2011
Materiality determined: —
Notification sent: —
Affected individuals: 935
Data types: IDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASIC
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1566 Phishing
Threat actor: Multiple
Regulator citations: HHS OCR investigation completed; CE provided documentation of all remedial actions

Compliance

Time to disclose: 7 weeks(49 days from discovery to filing)
Compliance flags: HHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Feb 18, 2011
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Feb 18, 2011 → Notified: not extracted	—	regulatory submission	HHS notified

Extraction provenance

Status: No extraction artifact recorded for this disclosure.