Health insurer Anthem hit by hackers, up to 80 million records exposed
Health insurer Anthem has confirmed the likely loss of millions of records relating to US citizens in what could be the largest cyberattack in the sector to date.
As reported by the Wall Street Journal, the healthcare insurance provider admitted that hackers managed to break into a database containing the personal information of up to 80 million people, including customers and employees.
The data breach, discovered last week, is being investigated by US law enforcement, but Anthem says that "tens of millions" of records were probably stolen.
According to a blog post by Joseph R. Swedish, President and CEO of Anthem, the personal data contained in the database included client names, dates of birth, physical and email addresses, medical IDs and Social Security numbers. Anthem says there is "no evidence" that medical information -- such as test results and diagnostics -- or financial data such as credit card and bank account records were taken.
The investigation, however, is ongoing.
It is worth noting that Anthem says both current and former customers and their data may have been compromised by the "very sophisticated external cyberattack."
The breach was detected by Anthem after an employee noticed a database query running on his identifier code although he did not initiate the search.
Once discovered, Anthem began working on a fix for the security vulnerability as well as immediately contacting the FBI. In addition, FireEye's cybersecurity and forensics firm Mandiant is now on the scene to evaluate the health insurance provider's systems and improve its security protocols.
"Anthem's own associates' personal information -- including my own -- was accessed during this security breach," Anthem's CEO said. "We join you in your concern and frustration, and I assure you that we are working around the clock to do everything we can to further secure your data."
Anthem plans to individually notify all current and former members whose information has been accessed, as well as provide credit monitoring and identity protection services free of charge. In addition, a toll-free number -- 1-877-263-7995 -- has been set up for those potentially affected to call. Swedish said:
Featured
"I want to personally apologize to each of you for what has happened, as I know you expect us to protect your information. We will continue to do everything in our power to make our systems and security processes better and more secure, and hope that we can earn back your trust and confidence in Anthem."
The publication says that FireEye believes the attack used customized techniques rather than off-the-shelf tools and was "very advanced."
The scale of this cyberattack is close to that suffered by US retailer Target and JPMorgan, the latter of which lost up to 76 million customer records. However, since the data breach has potentially exposed a wide range of information -- including Social Security numbers, health IDs and addresses -- there is a higher risk of identity theft.
Lior Arbel, CTO at information security firm Performanta told ZDNet:
"Another day and another huge data breach hits the headlines. This hack of tens of millions of Anthem customer information is seeing 2015 carrying on where 2014 left off with high-end data breaches of large enterprises. We have unmistakably now entered a phase in cyber-aggression where hackers have realised that information is power and have begun to up their attacks on corporate targets to steal vital intellectual property or consumer data.
Malicious actors are now proving time and again that they have the ability to circumvent traditional security solutions yet attacks are developing at a rate not matched by the defences.
Whilst Anthem is to be credited with discovering the breach themselves and notifying the public quickly, this must be seen as another wake-up call for organisations all over the world."
Read on: In the world of security
- Over 90 percent of data breaches in first half of 2014 were preventable
- Bluster, bravado and breaches: Today's 'terrorist' players in cybersecurity
- Verizon rushes fix for email account open season security flaw
- Hackers for hire: Anonymous, quick, and not necessarily illegal
Read on: Fixes and Flaws