HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Oct. 10, 2018.
- Organization as reported
- Cigna, CT
- Entity type as reported
- Health Plan
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- Oct. 10, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13666, row:4805)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Cigna, was the victim of a cyber-attack strategy known as “credential stuffing,” where hackers target individuals with the same log in credentials for different websites. The types of protected health information (PHI) involved in the incident included demographic, health claims, and clinical information of potentially 3,500 individuals. The CE provided breach notification to HHS and affected individuals and offered all affected individuals two years of identity protection services. Following the breach, the CE disabled affected accounts, added new firewalls, conducted a security risk assessment conducted a security risk assessment, and implemented additional security measures to prevent further access. As a result of OCR’s investigation, the CE provided updated copies of policies and procedures regarding breach notification, risk assessment, use and disclosures of PHI, and safeguarding PHI.