MISSOURIMultipleHealthcareFinancial ServicesHealthcareMisconfigurationMisdeliveryCustomer Data InvolvedMulti-Stage ChainIdentity (basic)Government IDHealth (basic)MediumResolved

UNION SECURITY INSURANCE COMPANY

bd_f4124a562d101179 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 18, 2011

Filed

Apr 8, 2011

To disclose

7 weeks

Affected

935

Confidence

94%

Full breach record for UNION SECURITY INSURANCE COMPANY →3 incidents on file

Union Security Insurance Company (MO), a Health Plan, reported to HHS on 2011-04-08 an Unauthorized Access/Disclosure affecting 935 individuals. Two incidents occurred: (1) On 2011-02-18, a policyholder discovered they could access other policyholders' online accounts (~1,500 affected) exposing names, DOBs, SSNs, and other identifiers due to a website coding flaw. (2) On 2013-05-17, an employee impermissibly emailed a spreadsheet with names and SSNs of ~1,127 group members. Breached information located in: Other. Remediation included disabling/recoding the website, increased vulnerability scans, employee retraining, and a ban on SSNs in customer documents.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS report on time7 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 7 weeks / 49 days

Feb 18, 2011

Begins

Feb 18, 2011

Discovered

Apr 8, 2011

Filed

vs. sector median

5 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed935 affectedView incident

Name: UNION SECURITY INSURANCE COMPANY
norm: union security insurance
Industry: Insurance — Health

Name: UNION SECURITY INSURANCE COMPANY
norm: union security insurance
Industry: Insurance — Health
Industry: Healthcaresource defaultFinancial Servicesllm

Discovered: Feb 18, 2011
Breach occurred: Feb 18, 2011 – May 17, 2013
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 935nationwide
Data types: Identity (basic)Government IDHealth (basic)
HHS breach type: Unauthorized access or disclosure
Where the data lived: Other
Covered-entity type: Health plan
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1566 Phishing
Threat actor: Multiple
Regulator citations: HHS OCR investigation completed; CE provided documentation of all remedial actions

During the incident: Notified HHS, affected individuals, and media
Engaged with OCR investigation
Provided OCR documentation substantiating all remedial actions
Changes made: Disabled website and reversed problematic coding
Increased vulnerability scans of website
Retrained employees on safeguarding social security numbers
Distributed revised policy and procedure for SSN protection
Prohibited social security numbers on any document sent to customers (per OCR direction)
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(49 days from discovery to filing)
Compliance flags: HHS report on timeHHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Feb 18, 2011
→ Notified: not extracted
— 60 days HHS report on time
HIPAA
Discovered: Feb 18, 2011
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Feb 18, 2011 → Notified: not extracted	—	60 days	HHS report on time
HIPAA	Discovered: Feb 18, 2011 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Apr 8, 2011
Raw hash: cf6a0e7d210ae82e0dab14e2ad0c05290a38417c0859370dc2cb925ef1c0c99d

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.2 KB

Download View at source

Reporting entityUNION SECURITY INSURANCE COMPANY

Victim entityUNION SECURITY INSURANCE COMPANY

Incidentdiscovered Feb 18, 2011

Stated responseNotified HHS, affected individuals, and media

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing