Cigna

The covered entity (CE), Cigna, was the victim of a cyber-attack strategy known as “credential stuffing,” where hackers target individuals with the same log in credentials for different websites. The types of protected health information (PHI) involved in the incident included demographic, health claims, and clinical information of potentially 3,500 individuals. The CE provided breach notification to HHS and affected individuals and offered all affected individuals two years of identity protection services. Following the breach, the CE disabled affected accounts, added new firewalls, conducted a security risk assessment conducted a security risk assessment, and implemented additional security measures to prevent further access. As a result of OCR’s investigation, the CE provided updated copies of policies and procedures regarding breach notification, risk assessment, use and disclosures of PHI, and safeguarding PHI.