A data breach at this company may have started as early as August 25, 2010, in the summer of 2010. The company didn’t say exactly how many victims may have had their data accessed over the last nine years. It’s possible the data wasn’t properly classified, something which could have allowed it to linger, on the servers as long as it did, unflagged. Perhaps the company didnt have the appropriate policies, mechanisms that can help detect and thwart unauthorized access, weren’t in place.”]
Source: https://digitalguardian.com/blog/data-breach-health-insurer-may-have-begun-nine-years-ago