Anthem's Historic Data Breach: What We Still Don't Know 2 Years Later

In February 2015, health insurer Anthem said its database had been compromised, exposing personal information for 78.8 million people, including 60 million to 70 million of its current and former customers and employees. Two years later, much of how it happened, who did it, and what consequences Anthem will face remain unanswered. From a report: Anthem has not disclosed the value of its cyber insurance policy, which defrays some of the costs. The hackers were most likely working on behalf of a foreign government. Many security experts believe it was China, but that has not been proven yet. The FBI would not comment on the pending investigation. It's unclear if Anthem will face a federal penalty. It's by far the largest health care data breach, and the Department of Health and Human Services has imposed fines in the past. We don't know for sure that Anthem was fully protected from this type of attack, and a separate federal agency that had a contract with Anthem previously said the insurer did not have controls in place "to prevent rogue devices...from connecting to its networks." Class-action lawsuits are still pending, and fact-finding discovery ended in December. Anthem could escape big damages if people can't show concrete harm.

with this admin in place

[TheGratefulNet]

ie, the US president and how he hates 'regulations', I expect nothing to happen to the company. we have to 'protect' companies, afterall, they are all too big to fail, in the cheeto benito's eyes.

little guys don't matter. for the next 4 years, we'll see nothing BUT this kind of lack of caring and lack of regulation. no penalties, either.

but hey, the conservates are STIGGINIT to us. yay conservatives!

Re:

[operagost]

So what did Obama do about this, again?

Oh, I know-- totally helpless with that obstinate Republican Congress. Yup, they stole his phone and his pen.

Anthem + OPM = Blackmail

[laughingskeptic]

Disparities between OPM records and medical records (for instance married persons being treated for venereal disease) provides intelligence blackmail targets.

What we still don't know...

[FrankSchwab]

As someone who was affected by this breach, I'll tell you what I still don't know.
I don't know what information about me and my family was disclosed. I don't know whether they got my name and account number, the list of payments they've made, the list of diagnostics codes for each of those payments. or what. When I called to find out, the answer was "our public statements are all the information that I have to give you". Basically, the bad guys know what they got, and Anthem won't tell me.
It sucks feeling so powerless about control of personal information.

wishful thinking

[Neuronwelder]

I hope the people who were hit, were the one's who wanted less Corporate regulation!!

Who are those 8+M extra people?

[aglider]

I would like to know who are those 8+M people ("persons") that are neither current not former customers and employees!
I suspect they also have collected and retained data about prospect-customers, wanna-be employees.
And I wonder how legal it is!

Re:

[Bob the Super Hamste]

I think you may be correct in the "prospect-customers, wanna-be employees". My wife recently got a letter from a school district she applied to before we were married stating that her personal information had been stolen. We think that the information was kept for 16 or 17 years but is at least 15 years old. Personally I am getting really sick and tired of getting the notifications that organization X has had a data breach and as such I will be granted 1 free year of credit monitoring by shit company Y that

Re:

[CaptainDork]

Yeah, privacy is like pulling teeth.

Re:

[bondsbw]

Government identifiers like SSN and DL number need to be replaced. Even then, they should never be used (directly) for non-government purposes.

We have much better options today. We need to start using them.

Class-action lawsuits are still pending

[NoSalt]

Ummm ... so does this mean I can sue the federal government (specifically the OPM) for allowing the Chinese to steal my personal information???