Press Release

Attorney General Ellison reaches settlement in data breach affecting 38,000 Minnesotans

Thirty states settle claims related to 2014–15 data breach that exposed sensitive medical information

July 11, 2019 (SAINT PAUL) – Attorney General Ellison settled a lawsuit today against Premera Blue Cross (“Premera”), a Washington-based insurance company that was alleged to have failed to protect the health and personal data of more than 38,000 Minnesotans. Minnesota was joined by 29 other states in settling the case. Under the settlement, Premera will pay $10 million and commit to numerous steps to safeguard its customers’ information going forward.

“Minnesotans deserve to know that their sensitive personal information is safe and their dignity is protected,” Attorney General Ellison said. “Premera failed to meet its legal obligations and violated Minnesotans’ trust by not adequately safeguarding their sensitive data. We held them accountable.”

The Premera data breach occurred from May 5, 2014 until March 6, 2015.  In the suit, the State alleged that a hacker took advantage of multiple known weaknesses in Premera’s network to access consumers’ sensitive personal information, including private health information, Social Security numbers, bank account information, names, addresses, phone numbers, dates of birth, member identification numbers, and email addresses.

The State of Minnesota further alleged that Premera misrepresented the adequacy of its data security procedures and falsely represented that individuals’ sensitive data was safe.

Under the settlement, Premera is required to: take numerous steps to ensure that its data security program protects personal health information, conduct regular audits of its data security program, and hire a chief information security officer who will hold meetings with Premera’s executive management.

Minnesota was joined in the case and settlement by the states of Alabama, Alaska, Arizona, Arkansas, California, Connecticut, Florida, Hawaii, Idaho, Indiana, Iowa, Kansas, Kentucky, Louisiana, Massachusetts, Mississippi, Montana, Nebraska, Nevada, New Jersey, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Rhode Island, Utah, Vermont, and Washington.