HackingHealthcareFinancial ServicesHealthcareDelayed DiscoveryMulti-Stage ChainIdentity (basic)Government IDFinancial accountHealth (basic)PHIMediumContained

Premera Blue Cross

bd_f653fc0c8376c853 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 29, 2015

Filed

Mar 17, 2015

To disclose

7 weeks

Affected

Not disclosed

Linked

10 filings

Confidence

66%

Full breach record for Premera Blue Cross →7 incidents on file

Premera Blue Cross notified the NH AG of a cyberattack discovered Jan 29, 2015, with initial access occurring May 5, 2014. Attackers may have accessed PHI, SSNs, and financial data. No evidence of data removal or fraud found. Premera engaged Mandiant, notified the FBI, and offered 2 years of credit monitoring. Total affected count unknown.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 269 days

discovery → filing · 7 weeks / 47 days

May 5, 2014

Begins

Jan 29, 2015

Discovered

Mar 17, 2015

Filed

vs. sector median

6 wks faster

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

HHS OCRbd_9a804b5de84dfb072015-03-17Verified
California State AGbd_e8e76c27f5c889f62015-03-17Candidate
Massachusetts State AGbd_de2d028bf0408dea2015-03-18 · +1dVerified
South Carolina State AGbd_9ec8af423fb684d52015-03-19 · +2dVerified

Show 5 more filings ↓up to 2019d gap

Hawaii State AGbd_13935cd688d3ab102015-03-24 · +7dVerified
New Hampshire State AGbd_69d72a8fe88cec392015-03-27 · +10dVerified
New Hampshire State AGbd_bc5a1df54eb15c132015-04-02 · +16dVerified
New Hampshire State AGbd_f240484574e352ba2015-05-04 · +48dVerified
HHS OCR enforcementbd_d2050db6681c56222020-09-25 · +2019dVerified by operator

Name: BAKER & HOSTETLER LLP
norm: baker hostetler

Name: Premera Blue Cross
norm: premera blue cross
Domain: premera.com
Industry: HealthcarellmFinancial Servicesllm

Discovered: Jan 29, 2015
Breach occurred: May 5, 2014
Undetected for: 269 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 17, 2015
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified the FBI
Initial access: exploit_public_facing

During the incident: Worked closely with Mandiant to conduct its investigation and to remove the infection created by the attack on its IT systems
Notified the FBI and continues to work closely with the agency on its investigation
Began to notify individuals affected by the incident
Providing call center support for those affected
Changes made: Taking actions to strengthen and enhance the security of its IT systems moving forward
Offering affected individuals two years of complimentary credit monitoring and identity theft protection services through Experian
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(47 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 6 states

View merged incident ↗

HHS OCRMar 17 · first

California State AGMar 17 · first

New Hampshire State AGMar 17 · first · this page

Massachusetts State AG+1d

South Carolina State AG+2d

Hawaii State AG+7d

New Hampshire State AG+10d

New Hampshire State AG+16d

New Hampshire State AG+48d

HHS OCR enforcement+2019d

Pattern: first filing Mar 17 (WA), last Sep 25 — a 2019-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/premera-blue-cross-20150317.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 17, 2015
Raw hash: 5914b10cd9700125f6b9c116060fe64a273b202f5d0d0123f82b7ea63aef17e1

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityBAKER & HOSTETLER LLP

Victim entityPremera Blue Cross

Incidentdiscovered Jan 29, 2015

Stated responseWorked closely with Mandiant to conduct its investigation and to remove the infection created by the attack on its IT systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov