What happened
Attackers compromised Premera Blue Cross in May 2014 and remained undetected for about nine months until January 2015. The intrusion exposed the protected health information of roughly 10.4 million individuals, including names, dates of birth, Social Security numbers, bank account details and clinical information. The HHS Office for Civil Rights, describing the incident, stated that the entry point was a spear-phishing email that installed malware.
How the deception worked
The intrusion started with a spear-phishing email sent to Premera staff which, when acted on, installed malware and gave the attackers an interactive foothold inside the health plan's network. From there they operated quietly for nine months, moving through systems that held member enrolment, claims and clinical data. The regulator's later findings emphasised that Premera had not run an adequate enterprise-wide risk analysis and lacked the monitoring that would have surfaced anomalous internal activity, which is why a single successful email turned into nine months of undetected access across a database of more than ten million members.
The control that would have caught it· our reading, not a claim from the sources
Email filtering and user reporting only reduce the odds; the decisive control here was internal detection, since the damage came from nine months of unnoticed lateral movement.
Sources (2)
- OCR Imposes 2nd Largest Ever HIPAA Penalty of $6.85 Million on Premera Blue CrossHIPAA Journal·hipaajournal.comOpen ↗
- Premera Blue Cross Breach Exposes Financial, Medical RecordsKrebs on Security·krebsonsecurity.comOpen ↗
This entry summarises public reporting. It is not a legal finding, and details can change as investigations conclude. Found an error? Send a correction.