Anthem Inc., the country’s second-biggest health insurer, said hackers broke into a database containing personal information for about 80 million of its customers and employees in what is likely to be the largest data breach disclosed by a health-care company.
Investigators are still determining the extent of the incursion, which was discovered last week, and Anthem said it is likely that “tens of millions” of records were stolen. The health insurer said the breach exposed names, birthdays, addresses and Social Security numbers but doesn’t appear to involve medical information or financial details such as credit-card or bank-account numbers, nor are there signs the data are being sold on the black market.
Anthem, which offers Blue Cross Blue Shield plans in California, New York and other states, said it doesn’t know precisely how many people may be affected. So far, it appears that the attack detected last week is the only breach of Anthem’s systems, and it isn’t yet clear how the hackers were able to obtain the identification information needed to access the database said Thomas Miller, the insurer’s chief information officer.
The insurer said it would reach out to everyone whose information was stored in the hacked database with a letter and, where possible, email. It is also setting up an informational website and will offer to provide a credit-monitoring service.
Its decision to reveal the attack days after its discovery, even as the investigation is getting under way, may signal a changing attitude among corporate executives about rapid disclosures in the wake of breaches of companies including Target Corp. , Home Depot Inc. and Sony Pictures Entertainment Inc.
Anthem detected the breach itself, which puts it in the minority among companies subject to such attacks, and “organizations don’t typically provide notification this early on,” said David Damato, managing director at FireEye Inc., owner of cybersecurity unit Mandiant, which Anthem has hired to investigate.
When hackers intruded on servers at J.P. Morgan Chase & Co. this summer, the incident was reported by media outlets weeks after the bank had learned there was an issue. The bank has said previously that only contact information was compromised and it has seen no fraud associated with the event.
Anthem’s Mr. Miller said the company wanted “to share the information as soon as possible.” Federal law requires health-care companies to inform consumers and regulators when they suffer a data breach involving personally identifiable information, but they have as many as 60 days after the discovery of an attack to report it.
Anthem, based in Indianapolis and formerly known as WellPoint, covers around 37.5 million people. The hacked database included information for some current and former customers as well as its own employees; it also held medical and financial details, but the insurer said those details don’t appear to be included in the data stolen by the hackers.
The Anthem incident could rank among the largest of recent attacks. The J.P. Morgan breach compromised contact information for about 76 million households. Home Depot has said 56 million credit-card accounts were compromised, and 53 million customer email addresses stolen. Target’s cyberattack affected 40 million payment cards. Both retailers offered credit monitoring after the fact and banks typically reimburse consumers for fraudulent charges resulting from a data breach.
Daniel Nutkis, chief executive of the Health Information Trust Alliance, a nonprofit that helps health-care companies with computer security, said the largest previously known hacker theft from a health-care company was last year’s intrusion at hospital operator Community Health Systems Inc., which involved records on 4.5 million consumers. In that case, the company said it regretted the breach and pointed to a group originating from China for the attack. Much of the sector remains vulnerable, and few have the ability to detect and respond to an attack as Anthem has, he said, though the alliance has already started warning other health-care companies about what happened to the big insurer.
Mr. Damato, of FireEye, said the firm has seen more cyberattacks specifically targeting health-care concerns. Health companies often hold rich stores of consumer data, including sensitive details of people’s prescriptions, care and illnesses.
He said the Anthem attack was “sophisticated” and used techniques that appeared to have been customized, rather than broadly available tools, and were “very advanced.” Investigators haven’t yet concluded who was behind the Anthem breach. Community Health Systems, for one, said it believed its incursion originated in China.
Anthem’s Mr. Miller said the first sign of the attack came in the middle of last week, when a systems administrator noticed that a database query was being run using his identifier code although he hadn’t initiated it. Anthem quickly determined that an attack had occurred, he said, informed the Federal Bureau of Investigation and hired Mandiant.
Investigators tracked the hacked data to an outside Web-storage service and were able to freeze it there, but it isn’t yet clear if the hackers were able to earlier remove it to another location, Mr. Miller said. The Web storage service used by the hackers, which Mr. Miller declined to name, was one that is commonly used by U.S. companies, which may have made the initial data theft harder to detect.
A spokesman for the FBI said the agency is “aware of the Anthem intrusion and is investigating the matter” and praised the insurer for its “initial response in promptly notifying the FBI after observing suspicious network activity.”
In the wake of the attack, Anthem has reset the passwords of all employees with higher-level access to its data systems, and has blocked all access that involves only one password, Mr. Miller said.
Anthem said it doesn’t expect the incident to affect its 2015 financial outlook, “primarily as a result of normal contingency planning and preparation.”
No comments:
Post a Comment