Indiana Attorney General’s office files lawsuit against WellPoint Inc. Lawsuit seeks payment of $300,000 in civil penalties. Indiana law requires businesses to notify customers and AG without unreasonable delay. Insurance policies containing Social Security numbers, financial information, and health records were potentially available to the general public through an unsecured Internet website for a period of at least 137 days between October 2009 and March 2010. WellPoint did not begin notifying customers of the security breach until June 18, the complaint says.”]
Source: https://www.darkreading.com/attacks-breaches/wellpoint-sued-for-delay-in-disclosing-security-breach