HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Jan. 24, 2019.
- Organization as reported
- Unum Group, on behalf of its subsidiaries - Unum Life Insurance and Colonial Life & Accident Insurance, TN
- Entity type as reported
- Health Plan
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- Jan. 24, 2019
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13561, row:4700)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Unum Group, reported that an employee was the victim of an email phishing scheme. The protected health information (PHI) involved included names, addresses, dates of birth, Social Security numbers, health diagnoses, and employer information. This breach affected 532 individuals. The CE retained legal counsel and hired forensic investigators to assist with the investigation. The CE provided breach notification to HHS and affected individuals. In addition, Unum deleted the phishing email from mailboxes, forced password resets, updated and completed a risk analysis, implemented multi-factor authentication, reduced email retention, blocked suspicious websites, and provided supplemental HIPAA training to its workforce. OCR provided the CE with technical assistance regarding timely breach notification. OCR obtained assurances that the CE met its notification requirements and implemented the corrective actions noted above.