Anthem medical data breach

Short description: Data breach of Anthem Inc

The Anthem medical data breach was a medical data breach of information held by Elevance Health, known at that time as Anthem Inc.

On February 4, 2015, Anthem, Inc. disclosed that criminal hackers had broken into its servers and had potentially stolen over 37.5 million records that contain personally identifiable information from its servers.[1] On February 24, 2015 Anthem raised the number to 78.8 million people whose personal information had been affected. [2] According to Anthem, Inc., the data breach extended into multiple brands Anthem, Inc. uses to market its healthcare plans, including, Anthem Blue Cross, Anthem Blue Cross and Blue Shield, Blue Cross and Blue Shield of Georgia, Empire Blue Cross and Blue Shield, Amerigroup, Caremore, and UniCare.[3] Healthlink says that it was also a victim.[4] Anthem says users' medical information and financial data were not compromised. Anthem has offered free credit monitoring in the wake of the breach.[5] Michael Daniel, chief adviser on cybersecurity for President Barack Obama, said he would be changing his own password.[6] According to The New York Times, about 80 million company records were hacked, and there is a fear that the stolen data will be used for identity theft. [7] The compromised information contained names, birthdays, medical IDs, social security numbers, street addresses, e-mail addresses and employment information, including income data.[8][9]

## Contents

* 1 Theft of the data
* 2 Impact
* 3 Responses
* 4 References
* 5 External links

## Theft of the data

The data was stolen over a period of weeks the month before the data breach was discovered.[10]

Because no medical information was compromised, Anthem was not required by law to encrypt the data.[11] However, Anthem faced several civil class-action lawsuits, which were settled in 2017 at a cost of $115 million. Anthem did not admit any wrongdoing in the settlement.[12]

Data from the attack is expected to be sold on the black market.[13]

## Impact

Persons whose data was stolen could have resulting problems about identity theft for the rest of their lives.[14] Anthem had a US$100 million insurance policy for cyber problems from American International Group.[15] One report suggested that all of this money could be consumed by the process of notifying customers of the breach.[15]

## Responses

Anthem hired Mandiant, a cybersecurity firm, to review their security systems and advised people whose data was stolen to monitor their accounts and remain vigilant.[16][17]

The theft of the data raised fears generally about the theft of medical information.[18][19] A writer from Harvard Law School suggested that this data breach might spark reform of security practices and government data safety regulation.[20]

An investigation conducted by several state insurance commissioners blames the breach on an attacker whose identity was withheld, and claims that the breach was likely ordered by a foreign government whose name was withheld.[21] It also concluded that Anthem had taken reasonable measures to protect its data before the breach and that its remediation plan was effective at shutting down the breach once it was discovered.[21] It also marks the starting date of the breach as February 18, 2014.[21] The lead investigator was the Indiana Department of Insurance (DOI) -- Anthem's principal regulator, because Anthem is headquartered in Indiana.[22] The Indiana DOI hired independent auditors to conduct a security assessment at Anthem, which concluded, "While deficiencies within Anthem’s cybersecurity posture were noted by the Examination Team, these deficiencies were not, in our experience, uncommon to companies comparable to Anthem in size and scope. While the pre-breach deficiencies impacted Anthem’s ability to reduce the likelihood of and quickly detect the Data Breach, the controls implemented subsequent to the Data Breach should improve Anthem’s ability to detect future breaches and enable Anthem to respond more effectively to a future attack than was the case in this instance."[22]

Federal regulators also conducted an investigation of the Anthem data breach, resulting in a $16 million settlement between Anthem and the Department of Health and Human Services (HHS) -- by far the largest HHS data breach settlement.[23] An HHS Director overseeing the investigation said, "The largest health data breach in U.S. history fully merits the largest HIPAA settlement in history. Unfortunately, Anthem failed to implement appropriate measures for detecting hackers who had gained access to their system to harvest passwords and steal people's private information."[23] The HHS settlement also required Anthem to perform a risk assessment and correct any identified deficiencies in its cybersecurity, with HHS oversight of Anthem's progress.[23]

Approximately 100 private class action lawsuits were filed against Anthem over the data breach and consolidated in California federal court, in front of Judge Koh, a respected authority in data breach litigation.[24] After contested briefing over who should lead the litigation efforts, Judge Koh appoints Eve Cervantez of Altshuler Berzon and Andy Friedman of Cohen Milstein as co-lead counsel, and appointed Eric Gibbs of Gibbs Law Group and Michael Sobel of Lieff Cabraser to head a Plaintiffs' Steering Committee.[25] In 2017, Anthem agreed to settle the litigation for $115 million, the largest ever data breach settlement at the time.[26] The attorneys requested $38 million in fees for their work on the case, but Judge Koh slashed the fee request, finding that only $31 million in fees were merited.[27]

## References

1. ↑ Riley, Charles (4 February 2015). "Insurance giant Anthem hit by massive data breach". CNN Money. https://money.cnn.com/2015/02/04/technology/anthem-insurance-hack-data-security/.
2. ↑ Mathews, Anna (24 February 2015). "Anthem: Hacked Database Included 78.8 Million People". Wall Street Journal. ProQuest 1657641740. https://www.wsj.com/articles/anthem-hacked-database-included-78-8-million-people-1424807364.
3. ↑ "Data Breach at Health Insurer Anthem Could Impact Millions — Krebs on Security". KrebsOnSecurity. 5 February 2015. http://krebsonsecurity.com/2015/02/data-breach-at-health-insurer-anthem-could-impact-millions/.
4. ↑ "Healthlink homepage". Center of page; even the Anthem page doesn't reference Healthlink.. http://www.healthlink.com/.
5. ↑ Pepitone, Julianne (5 February 2015). "Anthem Hack: Credit Monitoring Won't Catch Medical Identity Theft". NBC News. http://www.nbcnews.com/tech/security/anthem-hack-credit-monitoring-wont-catch-medical-identity-theft-n300836.
6. ↑ Michael A Riley (5 February 2015). "Chinese State-Sponsored Hackers Suspected in Anthem Attack". Bloomberg.com. https://www.bloomberg.com/news/articles/2015-02-05/signs-of-china-sponsored-hackers-seen-in-anthem-attack.
7. ↑ Abelson, Reed; Goldstein, Matthew (5 February 2015). "Anthem Hacking Points to Security Vulnerability of Health Care Industry". The New York Times. https://www.nytimes.com/2015/02/06/business/experts-suspect-lax-security-left-anthem-vulnerable-to-hackers.html.
8. ↑ Weise, Elizabeth (5 February 2015). "Massive breach at health care company Anthem Inc.". USA Today (McLean, VA: Gannett). ISSN 0734-7456. https://www.usatoday.com/story/tech/2015/02/04/health-care-anthem-hacked/22900925/.
9. ↑ Mathews, Anna; Yadron, Danny (4 February 2015). "Health Insurer Anthem Hit by Hackers - WSJ". Wall Street Journal. ProQuest 1651251003. https://www.wsj.com/articles/health-insurer-anthem-hit-by-hackers-1423103720.
10. ↑ Zetter, Kim (5 February 2015). "Health Insurer Anthem Is Hacked, Exposing Millions of Patients' Data". Wired. https://www.wired.com/2015/02/breach-health-insurer-exposes-sensitive-data-millions-patients/. Retrieved 20 February 2015.
11. ↑ Whitney, Lance (6 February 2015). "Anthem's stolen customer data not encrypted". CNET. http://www.cnet.com/news/anthems-hacked-customer-data-was-not-encrypted/.
12. ↑ Freeman, Liz (26 June 2017). "Anthem settles a security breach lawsuit affecting 80M". USA Today. ProQuest 1913564990. https://www.usatoday.com/story/money/business/2017/06/26/anthem-settles-security-breach-lawsuit-affecting-80m/103217152/.
13. ↑ Murphy, Tom; Bailey, Brandon (6 February 2015). "Why hackers are targeting the medical sector". Boston Globe. https://www.bostonglobe.com/business/2015/02/06/why-hackers-are-targeting-medical-sector/xxjFN6G3cFJZ8Fh3mF3XhN/story.html.
14. ↑ Rudavsky, Shari (7 February 2015). "Anthem data breach could be 'lifelong battle' for customers". IndyStar. http://www.indystar.com/story/news/2015/02/05/anthem-data-breach-lifelong-battle-customers/22953623/.
15. ↑ 15.0 15.1 Osborne, Charlie (12 February 2015). "Anthem data breach cost likely to smash $100 million barrier". ZDNet. https://www.zdnet.com/article/anthem-data-breach-cost-likely-to-smash-100-million-barrier/.
16. ↑ Popken, Ben; Grant, Kelli (6 February 2015). "Anthem Breach: What Should I Do Right Now?". NBC News. https://www.nbcnews.com/business/consumer/anthem-breach-what-should-i-do-right-now-n300796.
17. ↑ McNeal, Gregory S. (4 February 2015). "Health Insurer Anthem Struck By Massive Data Breach". Forbes. https://www.forbes.com/sites/gregorymcneal/2015/02/04/massive-data-breach-at-health-insurer-anthem-reveals-social-security-numbers-and-more/.
18. ↑ Terhune, Chad (5 February 2015). "Anthem hack raises fears about medical data". Los Angeles Times (Los Angeles). ISSN 0458-3035. http://www.latimes.com/business/la-fi-anthem-hack-fallout-20150206-story.html.
19. ↑ Abelson, Reed; Creswellfeb, Julie (6 February 2015). "Data Breach at Anthem May Forecast a Trend". The New York Times (New York). ISSN 0362-4331. https://www.nytimes.com/2015/02/07/business/data-breach-at-anthem-may-lead-to-others.html.
20. ↑ Terry, Nicholas (7 February 2015). "Time for a Healthcare Data Breach Review?". Bill of Health. Petrie-Flom Center for Health Law Policy at Harvard Law School. https://blog.petrieflom.law.harvard.edu/2015/02/07/time-for-a-healthcare-data-breach-review/.
21. ↑ 21.0 21.1 21.2 "Investigation of major Anthem cyber breach reveals foreign nation behind breach" (Press release). Sacramento, California: California Department of Insurance. 2017-01-17. Archived from the original on 2017-02-17. Retrieved 2017-02-16.
22. ↑ 22.0 22.1 "Multistate Targeted Market Conduct and Financial Examination of Anthem Insurance Companies". National Association of Insurance Commissioners. http://www.insurance.ca.gov/0400-news/0100-press-releases/2016/upload/Anthem-Examination-Report-AM-2016-12-01.pdf.
23. ↑ 23.0 23.1 23.2 Telchert, Erica (16 October 2018). "Anthem to pay $16M in record data breach settlement". Modern Healthcare. https://www.modernhealthcare.com/article/20181016/NEWS/181019927.
24. ↑ Trade, Steven. "Blue Cross Entities Want Out Of Anthem Data Breach MDL". Law360. https://www.law360.com/articles/730750/blue-cross-entities-want-out-of-anthem-data-breach-mdl.
25. ↑ "Plaintiffs' Counsel Announce $115 Million Proposed Class Action Settlement in Anthem Data Breach Litigation". 2017-06-23. https://www.marketwatch.com/press-release/plaintiffs-counsel-announce-115-million-proposed-class-action-settlement-in-anthem-data-breach-litigation-2017-06-23.
26. ↑ Pierson, Brendan (23 June 2017). "Anthem to pay record $115 million to settle U.S. lawsuits over data breach". Reuters. https://www.reuters.com/article/us-anthem-cyber-settlement/anthem-to-pay-record-115-million-to-settle-u-s-lawsuits-over-data-breach-idUSKBN19E2ML.
27. ↑ Andrews, Greg (20 August 2018). "Anthem data-breach judge OKs huge fee award, but not as much as attorneys wanted". Indianapolis Business Journal. https://www.ibj.com/articles/70144-anthem-data-breach-judge-oks-huge-fee-award-but-not-as-much-as-attorneys-wanted.

## External links

* AnthemFacts, Anthem's own website for supporting its customers whose data had been breached
* Data Breach Litigation, Class Action Settlement

* v
* t
* e

Hacking in the 2010s

| <- 2000s | Timeline | 2020s ->

|
|

Major incidents|

| 2010|

* Operation Aurora
* Australian cyberattacks
* Operation ShadowNet
* Operation Payback

|

2011|

* DigiNotar
* DNSChanger
* HBGary Federal
* Operation AntiSec
* Operation Tunisia
* PlayStation
* RSA SecurID compromise

2012|

* LinkedIn hack
* Stratfor email leak
* Operation High Roller

2013|

* South Korea cyberattack
* Snapchat hack
* Cyberterrorism Attack of June 25
* 2013 Yahoo! data breach

2014|

* Anthem medical data breach
* Operation Tovar
* iCloud leaks of celebrity photos
* 2014 JPMorgan Chase data breach
* Sony Pictures hack
* Russian hacker password theft
* 2014 Yahoo! data breach

2015|

* Office of Personnel Management data breach
* Hacking Team
* Ashley Madison data breach
* VTech data breach
* Ukrainian Power Grid Cyberattack
* SWIFT banking hack

2016|

* Bangladesh Bank robbery
* Hollywood Presbyterian Medical Center ransomware incident
* Commission on Elections data breach
* Democratic National Committee cyber attacks
* Vietnam Airport Hacks
* DCCC cyber attacks
* Indian Bank data breaches
* Dyn cyberattack
* Russian interference in the 2016 U.S. elections

2017|

* 2017 Macron e-mail leaks
* WannaCry ransomware attack
* Westminster cyberattack
* Petya cyberattack
* 2017 cyberattacks on Ukraine
* Equifax data breach
* Deloitte breach
* Disqus breach

2018|

* Trustico
* Exactis
* Atlanta cyberattack

2019|

* Sri Lanka cyberattack
* Baltimore ransomware attack
* 2019 Bulgarian revenue agency hack
* Capital One data breach
* Zynga Breach

Groups|

| Hacktivism|

* Anonymous
* associated events
* CyberBerkut
* GNAA
* Goatse Security
* Lizard Squad
* LulzRaft
* LulzSec
* New World Hackers
* NullCrew
* OurMine
* PayPal 14
* RedHack
* TeaMp0isoN
* UGNazi

|

Advanced Persistent Threat|

* Bureau 121
* Carbanak (group)
* Charming Kitten
* Cozy Bear
* Elfin Team
* Equation Group
* Fancy Bear
* FreeMilk
* Guccifer 2.0
* Hacking Team
* Helix Kitten
* Iranian Cyber Army
* Lazarus Group (BlueNorOff) (AndAriel)
* NSO Group
* PLA Unit 61398
* PLA Unit 61486
* PLA Unit 78020
* PLATINUM
* Pranknet
* Red Apollo
* Rocket Kitten
* Syrian Electronic Army
* Tailored Access Operations
* The Shadow Brokers
* Yemen Cyber Army

Individuals|

* DkD[||
* George Hotz
* Guccifer
* Jeremy Hammond
* Junaid Hussain
* Kristoffer von Hassel
* Mustafa Al-Bassam
* MLT
* Ryan Ackroyd
* Sabu
* Topiary
* Track2
* The Jester
* weev

Major vulnerabilities
publicly disclosed|

* Evercookie (2010)
* iSeeYou (2013)
* Heartbleed (2014)
* Shellshock (2014)
* POODLE (2014)
* Rootpipe (2014)
* Row hammer (2014)
* JASBUG (2015)
* Stagefright (2015)
* DROWN (2016)
* Badlock (2016)
* Dirty COW (2016)
* Cloudbleed (2017)
* Broadcom Wi-Fi (2017)
* EternalBlue (2017)
* DoublePulsar (2017)
* Silent Bob is Silent (2017)
* KRACK (2017)
* ROCA vulnerability (2017)
* BlueBorne (2017)
* Meltdown (2018)
* Spectre (2018)
* EFAIL (2018)
* Speculative Store Bypass (2018)
* Lazy FP State Restore (2018)
* TLBleed (2018)
* SigSpoof (2018)
* Foreshadow (2018)
* Fallout (2019)
* RIDL (2019)
* ZombieLoad (2019)
* BlueKeep (2019)

Malware|

| 2010|

* Bad Rabbit
* Stuxnet

|

2011|

* Kelihos
* Stars
* Metulji botnet
* Duqu
* Alureon

2012|

* Mahdi
* Carna
* Flame
* FBI
* Shamoon
* Red October
* Dexter

2013|

* DarkSeoul
* CryptoLocker

2014|

* Careto
* DarkHotel
* Duqu 2.0
* Dyreza
* FinFisher
* Brambul
* Destover
* Gameover ZeuS
* Carbanak

2015|

* Dridex
* Rombertik
* TeslaCrypt
* Hidden Tear

2016|

* Hitler
* Petya (NotPetya)
* KeRanger
* Jigsaw
* Pegasus
* Mirai
* X-Agent

2017|

* LogicLocker
* BrickerBot
* WannaCry

2018|

* Kraken

2019|

* ElectricFish
* Grum
* Joanap
* MEMZ
* NetTraveler
* NSA ANT catalog
* R2D2
* Regin
* Tinba
* Titanium
* Vault 7
* X-Tunnel
* ZeroAccess

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/Anthem medical data breach. Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Anthem_medical_data_breach&oldid=3977344"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template