Premera Blue Cross Data Breach (2015)

Disclosed in March 2015, the Premera breach involved attackers who had maintained access to the company's network since May 2014. The attackers accessed a wide range of sensitive data including member names, addresses, dates of birth, Social Security numbers, bank account information, and clinical health records. The breach was discovered in January 2015 but took nearly two months to publicly disclose. Security researchers and media reports suggested the attack bore hallmarks of state-sponsored hacking activity, potentially linked to China-based threat actors. The breach was particularly significant because it exposed intimate health information in addition to financial data.

Premera Blue Cross is a nonprofit health insurance company serving the Pacific Northwest. The healthcare industry had become a prime target for cyberattacks due to the wealth of sensitive personal and medical data held by insurers.

The attackers used spear-phishing emails to gain initial access to Premera's network, then moved laterally to access databases containing member records. The prolonged access period (10 months) indicated sophisticated stealth capabilities.

MITRE ATT&CK techniques

• T1566.001

The attack was attributed to a suspected state-sponsored actor, though the specific group was not publicly named. The sophistication and duration of the attack suggested an advanced persistent threat (APT) group with significant resources.

Aliases

• Suspected Chinese APT

Attribution sources

• Media Reports
• Security Researchers

Countries affected

• United States

Data types

• PII
• Names
• SSN
• Bank Account Info
• Medical Records
• Clinical Data

Notable documents

• Premera breach notification letters

Legal settlements, regulatory fines, and remediation costs in the hundreds of millions.

Public reaction

Significant alarm about the security of healthcare data and the length of time the breach went undetected.

Political impact

The breach contributed to increased regulatory scrutiny of healthcare cybersecurity under HIPAA.

Geopolitical consequences

The suspected state-sponsored nature of the attack highlighted the value of health data as an intelligence target.

Premera faced multiple class-action lawsuits and regulatory fines.

Civil lawsuits

• Multiple class-action lawsuits

Policy changes

• Increased HIPAA enforcement and penalties for data breaches.

Regulatory changes

• Stricter requirements for healthcare data protection under HIPAA Omnibus Rule.

Security improvements

• Enhanced network monitoring and threat detection in healthcare sector.

Significance

The Premera breach was one of the largest healthcare data breaches in US history and demonstrated the vulnerability of health insurers to state-sponsored attacks.

Legacy

The incident underscored the need for stronger cybersecurity in the healthcare industry and the growing threat of nation-state attacks on medical data.

Publishing organisations

• Premera Blue Cross

Related events

• Anthem breach (2015)

Premera notified affected members, offered credit monitoring, and enhanced security measures.

Official documents

• Premera breach notification to members

References

1. [1]Premera official disclosure (2015)
2. [2]Media reports (Reuters, The Seattle Times)