Premera Blue Cross

Premera Blue Cross (WA/AK) reported to HHS OCR on 2015-03-17 a Hacking/IT Incident affecting 11,000,000 individuals, with breached information located on Network Servers. Attackers used a phishing email in May 2014 to install malware enabling unauthorized access for ~9 months until January 2015 (advanced persistent threat). Exposed PHI included names, addresses, dates of birth, email addresses, SSNs, bank account information, and health plan clinical data for 10.4M+ individuals. PBC settled with OCR for $6.85M — the second-largest HIPAA resolution in OCR history — and agreed to a corrective action plan with two years of monitoring.

Affected (this filing):

Premera Blue Cross reported a data breach to the Hawaii Office of Consumer Protection. The office was notified on 2015/03.24. Breach type: Hackers/Unauthorized Access. 19,174 Hawaii residents were affected. Recovered from the Internet Archive after the notice was removed from the OCP table.