Hackers broke into the company’s database in an attack bound to stoke fears many people have about the privacy of their most sensitive information. Photo: Michael Conroy
New York: Anthem, the second biggest US health insurer by market value, said hackers obtained data on tens of millions of current and former customers and employees in a sophisticated attack that has led to a Federal Bureau of Investigation probe.
The information compromised includes names, birthdates, Social Security numbers, medical IDs, street and e-mail addresses and employee data, including income, Anthem said. The company will notify customers who were affected and provide credit and identify-theft monitoring services for free, Chief Executive Officer Joseph Swedish said in a letter to members.
“As soon as we learned about the attack, we immediately made every effort to close the security vulnerability, contacted the FBI and began fully cooperating with their investigation,” Anthem said. The Indianapolis-based company, formerly known as WellPoint, didn’t provide information on how the breach occurred or when it was discovered.
The hacking of personal data has become a major issue for consumers and companies alike.
There’s no evidence that credit-card numbers or medical information such as claims, test results or diagnostic codes were compromised, Anthem said.
The Anthem breach is the biggest in the health-care industry since Chinese hackers stole Social Security numbers, names and address from 4.5 million patients of Community Health Systems, the second-biggest for-profit hospital chain, last year. The attack is on a similar scale to hacks of customer data from Target and Home Depot last year in terms of the number of people affected.
“This attack is another reminder of the persistent threats we face,” US Representative Michael McCaul, a Texas Republican who leads the Homeland Security Committee, said.
It’s not known yet where the attack came from or how the hackers got inside Anthem’s computer systems, said Vitor De Souza, spokesman for FireEye Inc., whose Mandiant division was hired this weekend to investigate the breach and began sending specialists to Anthem’s headquarters.
What is known is that the malicious software used to infiltrate the network and steal data was customised, which can be a sign of an advanced attacker, and is a variant of a known family of hacking tools, Mr De Souza said. What’s rare in this case is that Anthem discovered the breach itself, instead of being alerted to it by a third party such as a bank or a credit-card company, Mr De Souza said. Such organisations are often the first to detect fraud and link stolen data to a hacking attack.
Investigators were able to track the stolen data to an Internet storage service that the attackers were using to warehouse their pilfered information, he said.
Mr De Souza added that Mandiant, which has investigated such big- name breaches as Sony Pictures Entertainment and JPMorgan Chase & Co., is seeing more attacks against health-care companies, which are repositories of personal information that can be used for all kinds of fraud.
“We have seen a large uptick in health-care attacks — health care is now a common vector of attack,” he said. “You have your traditional ones, government, finance, high-tech and critical infrastructure are dominating, but health care and legal stand out as among the fastest-growing attack vectors in the world.”
Aetna Inc., the third-largest US insurer, said in 2009 it was notifying about 65,000 people that their personal information, including Social Security numbers, may have been compromised on a job applicant site in 2009.
Social Security numbers are among the worst kind of data to have stolen, because they are difficult to change and are used pervasively, especially for access to medical care, government services and opening new lines of credit.
Most large breaches, such as Target’s, involve payment-card numbers, as those are of most immediate and easiest use for cyber-criminals, who exploit the gap between when information is taken and when companies discover a breach to withdraw cash from ATMs and run up fraudulent charges before the cards are canceled. For cyber-criminals, Social Security numbers are more useful, in that they can be used to validate people to lenders, but they require the extra step of setting up new accounts, which some online crooks find too time-consuming and risky.
Bloomberg