Salem - The Oregon Insurance Division will participate in a multistate investigation of LifeWise Health Plan of Oregon and its parent company Premera Blue Cross. The investigation follows LifeWise's disclosure last week that a cyber attack exposed the personal identifying information of 250,000 Oregonians to unauthorized access. The information exposed includes:
* Name
* Date of birth
* Social Security number
* Mailing address
* Email address
* Telephone number
* Member identification number
* Bank account information
* Claims information, including clinical information
"Oregon takes the protection of personal identifying information very seriously and this investigation will closely scrutinize the data security practices of LifeWise," said Oregon Insurance Commissioner Laura Cali. "Oregon will be looking at how LifeWise learned about the breach, what process they used to identify affected consumers, and the adequacy of the consumer protections offered to those affected."
Washington will supervise the investigation, with Oregon and Alaska taking lead roles. The exact scope of the investigation is still under discussion, but will likely include:
* All cybersecurity aspects of the breach, including understanding the process LifeWise used to discern which members were affected and what information was compromised
* LifeWise's response to the breach and any corrective actions it has taken
* The financial impact of the breach on consumers, providers, and LifeWise
The participating states will likely contract with a cybersecurity firm to help investigate:
* When and how the data was breached
* Whether the breach stopped and if so, when
* What data was compromised
* How the attack was able to succeed
* Whether the company has taken effective steps to prevent a future attack.
Consumers who believe they may be affected by the LifeWise security breach can find information about protecting their identities at www.lifewiseupdate.com.
The Insurance Division is part of the Department of Consumer and Business Services, Oregon's largest business regulatory and consumer protection agency. Visit www.dcbs.oregon.gov andwww.insurance.oregon.gov.
March 25, 2015
