Premera Blue Cross settles state data breach investigations for $10 million

The case is the latest example of how state attorneys are taking legal action following large-scale security incidents.

The largest health insurance company in the Pacific Northwest says it will pay $10.4 million to 30 states to settle an investigation into a data breach that compromised information on more than 10 million people.

The settlement, entered into court Thursday, requires Premera Blue Cross to pay $5.4 million to Washington to resolve an investigation that determined the company was slow to patch known security vulnerabilities. Hackers had access to customers’ medical records, bank account information and Social Security numbers from May 2014 until May 2015. The remaining $5 million will be split between other states.

The case is the latest example of how, in the absence of federal leadership, state attorneys are taking legal action following large-scale security incidents. Connecticut and Illinois have opened investigations into the breach this year at the American Medical Collection Agency, which affected at least 20 million people. Other state lawsuits have resulted in settlements from Equifax, Uber and others.

This resolution comes just weeks after Premera agreed to pay $74 million to settle a class action lawsuit stemming from the same security incident. State attorneys general accused the not-for-profit health organization of failing to meet its obligations under the Health Insurance Portability and Accountability Act, as well as violating various state consumer protection laws.

“Premera had an obligation to safeguard the privacy of millions of Washingtonians — and failed,” Washington State Attorney General Bob Ferguson said in a statement. “As a result, millions had their sensitive information exposed. Premera repeatedly ignored both its own employees and cybersecurity experts who warned millions of consumers’ sensitive health information was at risk.”

Premera, based in the Seattle suburbs, has said it takes protecting customers’ security seriously.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure