HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Jan. 15, 2019.
- Organization as reported
- Humana Inc., KY
- Entity type as reported
- Health Plan
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Other
- Submission date
- Jan. 15, 2019
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13573, row:4712)
- Archived copy
- Held in the private archive (provenance)
From December 1, 2018, to December 3, 2018, the covered entity’s (CE) mobile app, Humana @ Home, experienced a credential stuffing attack, whereby a bad actor verified valid log-in credentials for the CE’s members. The bad actor was not able to access protected health information (PHI) on the Humana @ Home app, but instead used the verified credentials to log-in to Humana’s Go365 app, gaining potential access to 749 individuals’ names, dates of birth, addresses, provider’s names, dates of medical service, and types of medical service. Of the affected individuals, 598 were the CE’s members and the remaining 151 were employees of self-insured entities that contract with Humana to administer their insurance programs. Humana notified all these entities of the breach. To mitigate the breach, the CE deactivated the Humana @ Home app, and implemented two-step authentication on all of their apps and websites. Humana provided breach notification to HHS, the 598 affected individuals that are Humana insurance members, and to the employers of the other affected individuals. Humana did not provide media notification because there were no states in which more than 500 individuals were affected. OCR obtained assurances that the CE implemented the corrective actions listed above.