Premera data breach victims say insurer destroyed evidence

Published 12:00 am Sunday, September 2, 2018

Consumers suing health insurer Premera Blue Cross for negligence after it disclosed being victim to a huge data breach in 2015 now allege that the company intentionally destroyed a key computer that was compromised and data loss logs that likely held evidence for their case.

The consumers want a federal judge to issue sanctions against the insurance company for destroying the evidence after lawsuits were filed.

“Sanctions are warranted as this destruction has harmed Plaintiffs’ ability to analyze these relevant, critical pieces of evidence,” wrote their attorneys Kim Stephens, of Seattle, and Keith Dubanevich, of Portland, in a motion filed this week in U.S. District Court in Portland. “It knew that this evidence was critically relevant to the litigation.”

Dozens of cases filed in Oregon, Seattle and elsewhere have been consolidated in one class-action suit before U.S. District Judge Michael Simon in Portland. Both sides are in the evidence discovery phase of the case set for trial next year.

The plaintiffs allege the massive data breach to the health insurer compromised the confidential information of approximately 11 million current and former subscribers and employees of Premera. The sensitive information included personal, medical and financial data, such as names, dates of birth, Social Security numbers and medical claims.

Premera’s data breach expert identified 35 computers that were hacked after the company discovered the breach in January 2015, but when the plaintiffs asked for “forensic images” of each of the computers, the company said it could produce images for 34 of the computers, and that the 35th computer had been destroyed, according to court documents.

This 35th computer was loaded with Premera’s “most sensitive databases,” according to the plaintiffs’ lawyers. It was listed as destroyed on Premera records on Dec. 16, 2016, more than a year after the litigation began, the court filings show.

Further, data logs were destroyed that showed what information was coming in and out of the insurance company’s computer system.

Steve Kipp, spokesman for Premera Blue Cross, sought to downplay the significance of the missing computer and logs, and said the insurer’s lawyers will challenge in court the plaintiff’s motion for sanctions.

“It is the type of motion that is not uncommon in complex litigation involving voluminous physical and documentary evidence,” Kipp said. “We disagree with the motion and do not believe the facts justify the relief plaintiffs have requested.”

The plaintiffs in the case are pressing for a sanction considered extreme in the legal world: an instruction to the jury at trial that it can infer that the material destroyed by the company hacked would have harmed Premera. Usually, such an instruction — called an “adverse inference instruction,” proves too difficult for the defendant to overcome, legal experts say.

“A lesser sanction will not resolve the prejudice to Plaintiffs resulting from loss of the evidence,” the plaintiffs’ attorneys wrote.

They cited another federal civil case heard in Oregon where U.S. Magistrate Judge Paul Papak had approved sanctions for destruction of evidence.

In that case, PacifiCorp accused Gas Transmission Northwest, or GTN, of negligence, arising from shutdowns of a power plant in Hermiston caused by alleged contamination of its natural gas. PacifiCorp claimed that oil leaking from GTN’s compressor damaged fuel nozzles, causing the power outages. PacifiCorp preserved only 11 of the 350 fuel nozzles impacted. Because the destroyed fuel nozzles couldn’t be inspected, Papak restricted the expert testimony PacifiCorp could present at trial on the cause of the outages. He said he’d also issue a jury instruction, allowing the jury to infer that equipment destroyed by PacifiCorp would have been adverse to PacifiCorp’s case. The case settled before trial in 2014.

In that case, the judge weighed whether the destruction of the evidence was intentional and if there’s prejudice to one side as a result of the destroyed evidence. Sanctions could include the referenced jury instruction, exclusion of expert testimony or a dismissal. Destruction of evidence is considered “willful” if a party has some notice that it was “potentially relevant” to the litigation, Papak wrote.

In the Premera case, the health insurer hired a firm to investigate what happened once it became aware of the data breach. The hired investigators conducted a forensic examination of all the computers, and found on the computer that was later destroyed unusually large files that “more than likely were created by the attacker,” according to court records. Later, Premera’s hired investigators changed their story, writing that they couldn’t identify “attacker access to sensitive or protected information” on the particular computer.

“The destroyed computer was perfectly positioned to be the one-and-only staging computer hackers needed to create vast staging files for the purpose of shipping even more data outside of Premera’s network,” the plaintiff’s attorneys wrote in their motion. “Premera cannot be allowed to destroy evidence and point to its absence as a defense; such a defense would be highly misleading and unfairly prejudicial.”

Premera’s lawyers have until Sept. 28 to formally respond to the plaintiffs’ motion for sanctions on alleged discovery misconduct.

Marketplace