Supply chain ⛓ Supply Chain

Humana Third-Party Breach (September 2022)

📅 2022-09-01 🏢 Alight.com (Choice Health prev)
Primary Source ↗

Incident Details

Humana Announces Reports Third-Party Data Breach Involving Data Security Incident at Choice Health | JD Supra. On September 21, 2022, Humana confirmed that the company experienced a data breach after Choice Health, one of the companies Humana uses to help sell. The available information about the Humana / Choice Health data breach comes from the companies’ filings with various state attorneys general offices. According to these sources, on May 14, 2022, Choice Health was informed that an unauthorized party was offering data that was allegedly stolen from the Choice Health network. In response, Choice Health launched an internal investigation with the assistance of third-party cybersecurity specialists. Third-party company: Alight.com (Choice Health prev).

Technical Details

Initial Attack Vector
Compromise of third-party service provider / vendor relationship
Vendor / Product
Alight.com (Choice Health prev)
Supply Chain Attack
✅ Confirmed third-party / vendor compromise

Timeline

  1. 2022-09-01 Breach occurred
  2. 2022-09-01 Publicly disclosed