HUMANA INC.

Humana reported a data breach to the Montana Attorney General. The breach was reported on 2019-01-03. The breach occurred from 12/1/2018 to 12/4/2018. 4 Montana residents were affected.

Affected (this filing): 4

Humana Inc. reported to HHS on 2019-01-09 an Unauthorized Access/Disclosure affecting 1,211 members. On August 7, 2018, an unauthorized third party used stolen credentials belonging to employees of a business associate (BA) to access the BA's computer network containing PHI. Exposed data included names, dates of birth, insurance policy numbers, and last four SSN digits. The BA contacted the FBI; Humana notified HHS, affected individuals, and the media. Corrective actions were confirmed by OCR. Breached information located on Other system.

Affected (this filing): 1,211

Between Dec 1–3, 2018, attackers conducted a credential stuffing attack against Humana's 'Humana @ Home' mobile app, verifying valid member credentials. Although no PHI was accessible via Humana @ Home, the verified credentials were reused to log into Humana's Go365 app, exposing names, dates of birth, addresses, provider names, dates of service, and types of medical service for 749 individuals (598 Humana members reported to OCR; 151 additional were employees of self-insured employer clients). Humana deactivated the Humana @ Home app and rolled out two-step authentication across its apps and websites. OCR obtained assurances that corrective actions were implemented.

Affected (this filing): 598

The covered entity (CE), Humana, reported that its business associate (BA) experienced a cyber-attack that affected the electronic protected health information (ePHI) of 5,569 individuals. The ePHI involved included names, diagnoses, conditions, health insurance and other treatment information. The CE notified HHS, affected individuals, and the media.

Affected (this filing): 5,569