Second Largest Health Insurer In The US Hacked

H

HardOCP News

[H] News
Joined
Dec 31, 1969
Messages
0
Hackers have made off with the personal information of as many as 80 million current and former members of Anthem, the number two health insurer in the United States. :(

Anthem was the target of a very sophisticated external cyber attack. These attackers gained unauthorized access to Anthem’s IT system and have obtained personal information from our current and former members such as their names, birthdays, medical IDs/social security numbers, street addresses, email addresses and employment information, including income data. Based on what we know now, there is no evidence that credit card or medical information, such as claims, test results or diagnostic codes were targeted or compromised.
Click to expand...
 
I think enough evidence has proven that network security is an illusion. Time to revive the sneaker net.
 
Wow, this is not something that can be easily fixed like sending out a new creditcard.

"Names, birthdays, medical IDs/social security numbers, street addresses, email addresses and employment information"

You kidding me? They are gonna have a lawsuit on their hands.
 
striker444 said:
Wow, this is not something that can be easily fixed like sending out a new creditcard.

"Names, birthdays, medical IDs/social security numbers, street addresses, email addresses and employment information"

You kidding me? They are gonna have a lawsuit on their hands.
Click to expand...


LOL I'm guessing they added legalese in everything you sign when enrolling for their healthcare to remove your right to start a lawsuit.
 
Biznatch said:
LOL I'm guessing they added legalese in everything you sign when enrolling for their healthcare to remove your right to start a lawsuit.
Click to expand...
Even if they didn't, do you think the $3.56 you'd receive from a class action lawsuit would cover the cost of your identity theft?
 
We use Anthem Blue Cross Blue Shield, were I work. So I alerted our HR department and now I'm going to have to keep a close eye on my bank accounts and credit cards.

Since this would be a MAJOR HIPAA violation, some high level heads ARE going to roll over this. :eek:
 
striker444 said:
Wow, this is not something that can be easily fixed like sending out a new creditcard.

"Names, birthdays, medical IDs/social security numbers, street addresses, email addresses and employment information"

You kidding me? They are gonna have a lawsuit on their hands.
Click to expand...

I love how they are pushing forward that no credit card or medical information was accessed, at least as far as they know, but they don't mention that enough info was taken to get credit cards in your name.

I had Anthem until this first of this year, so as you can imagine, I'm not very happy at the moment.
 
Ripperjack said:
We use Anthem Blue Cross Blue Shield, were I work. So I alerted our HR department and now I'm going to have to keep a close eye on my bank accounts and credit cards.

Since this would be a MAJOR HIPAA violation, some high level heads ARE going to roll over this. :eek:
Click to expand...

Well unless actual medical information were accessed I don't think HIPPA would come into play.
 
How the hell do you even protect yourself from identity theft these days.
 
Can't wait to hear what they consider a "sophisticated attack".
 
Biznatch said:
Full names and socials is enough for a HIPAA violation.
Click to expand...

Correct.

As an example to how tenuous is our hold on personal data:

We do some work for a local charity. This charity receives donations of all kinds, some of which is IT. About a year ago, the director of the charity brought in two PCs that had come from a local hospital, wondering if they could be refurbished for any use. I opened them up and found a couple capacitors that were bulging so I informed him they were better off being recycled. I was about to send them off to the recycler when I thought "What if there is personal data on there?" We started them up and saw that there was, in fact, patient data on both the drives of the computers. I instantly yanked the power cord and called the director of the charity and explained to him that I was looking at several hundred thousand dollars of hipaa fines.

It turns out that the person responsible for the destruction of the data didn't want the time or expense of shredding it, so they just donated it to a local charity. We called the hospital and informed them (the person we spoke to was furious, but not at us) and also called the proper authorities. We never did hear if anything was done about it. If these types of things are happening here, they are happening everywhere.
 
Guess it's time to lock the credit since it seems like there is no such thing as private information any more. :(
 
Sometimes i hope these attacks are results of careless security and not the real security i hope to have on my "protected" accounts.
 
I got an e-mail with:

Once Anthem determined it was the victim of a sophisticated cyber attack, it immediately notified federal law enforcement officials and shared the indicators of compromise with the HITRUST C3 (Cyber Threat Intelligence and Incident Coordination Center).
Anthem’s Information Security has worked to eliminate any further vulnerability and continues to secure all of its data.
Anthem immediately began a forensic IT investigation to determine the number of impacted consumers and to identify the type of information accessed. The investigation is still taking place.
The information accessed includes member names, member health ID numbers/Social Security numbers, dates of birth, addresses, telephone numbers, email addresses and employment information, including income data. Social Security numbers were included in only a subset of the universe of consumers that were impacted.
Anthem is still working to determine which members’ Social Security numbers were accessed.
Anthem’s investigation to date shows that no credit card or confidential health information was accessed.
Anthem has advised there is no indication at this time that any of our clients’ personal information has been misused.
All impacted Anthem members will be enrolled in identity repair services. In addition, impacted members will be provided information on how to enroll in free credit monitoring.

Anthem has created a website – www.anthemfacts.com, and a hotline, 1-877-263-7995, for its members to call for more information, and has shared the attached Frequently Asked Questions (FAQs) that further explains the cyber attack.
 
I got a comp from the local goodwill. I guess it was from the local dentist office. It had about 500 hundred insurance and ss numbers ect.
 
Look, nothing is safe. Period. You are very foolish if you think anything is really protected, not shared, hardware encrypted, etc etc etc.

Let's say you have a music personality out there with HIV or movie star that will mostly likely be healthy the next decade or 15 - 20 years. Someone who is very well paid and has a long career ahead of him / her and trust me, there are many out there right now in this position.

All of a sudden, a hacker has this very personal information and contacts you in an attempt to black mail you.

This is horrible horrible news if that level of personal information was compromised.
 
You know, it almost seems as if this is all a very bad idea in the long run. Like it worked out really well for a while, but the whole everything connected and talking is really starting to suck.
 
Also, the super pixelated banner image is not helping restore faith in their technical prowess.

 
schizrade said:
Also, the super pixelated banner image is not helping restore faith in their technical prowess.

Click to expand...

Hah I thought the same thing. It was probably the only picture they could find of him that didn't make him look like an unapologetic smug asshole.
 
I saw a story a few years ago in which the news station, I think it was CBC, bought 5 old copiers and were able to pull thousands of documents off their hard drivers, one was from a police station and actually still had personnel documents sitting on the scanning bed.
 
With all of these hacks and compromised sites I'll probably get free credit monitoring forever.
 
"We noticed you've been monitoring your credit for an excessively long amount of time for someone who is only a middle class peon, therefore we've deducted 75 points from your credit score"
 
Honestly, we need a whole new identity paradigm somehow. I'm not sure how to reconcile it with personal liberty, do not track, etc...but the whole SSN thing was not designed for the computer age, and working in finance, identifying people is a huge PITA, particularly when the data for pretty much most Americans is available for purchase.

Shit, half the time the fraudsters can jump through the ID hoops easier than real people, because they have all the data in front of them, vs a real person trying to remember some of it off the top of their head. :(
 
A better, more technical, report on the attack:

The first sign of the incident came during the middle of last week, when a systems administrator noticed that a database query was being run using his passcode although he hadn’t initiated it. Anthem quickly determined that an attack had occurred.

Investigators tracked the hacked data to an outside Web-storage service and were able to freeze it there. But it’s possible the hackers already had copied it to another location.

The storage service used by the hackers was one that is commonly used by U.S. companies, which may have made the initial data theft harder to detect.
Click to expand...

http://www.nextgov.com/cybersecurity/threatwatch/2015/02/breach/2013/?oref=TW_hp_module
 
What will stop these corporations and businesses from using lackadaisical security practices? This is getting ridiculous.
 
Biznatch said:
Full names and socials is enough for a HIPAA violation.
Click to expand...

Because SSN's can be an patient identifier, disclosing it is NOT a HIPAA violation. This is why it was fine for insurance companies to issue insurance cards with your SSN on it. It may violate some state and more recent federal laws but it's not a violation of HIPAA.
 
I got this email too. I think these companies should get fined like copyright violations - $50k for every single person whose data is compromised. It's simply cheaper to pay for credit monitoring AFTER an attack than to implement hardened network and data security practices BEFORE one.
 
crusty_juggler said:
What will stop these corporations and businesses from using lackadaisical security practices? This is getting ridiculous.
Click to expand...

Who says that it was bad practices? They could have cutting edge security and it can all be rendered useless because someone clicked on a phishing link or someone doxxed enough information about an admin to trick someone into switching a password.
 
Ryokurin said:
Who says that it was bad practices? They could have cutting edge security and it can all be rendered useless because someone clicked on a phishing link or someone doxxed enough information about an admin to trick someone into switching a password.
Click to expand...

Guarantee they don't have cutting edge security if they don't notice 80 million records being accessed. That's like your whole house being emptied out by a thief and only noticing it when they take the lightbulbs.
 
Ryokurin said:
Who says that it was bad practices? They could have cutting edge security and it can all be rendered useless because someone clicked on a phishing link or someone doxxed enough information about an admin to trick someone into switching a password.
Click to expand...
Or it could have even been malicious. Maybe a former admin caught wind that he was going to get fired, and worked alongside the black hats for monetary reward.
 
dr/owned said:
Guarantee they don't have cutting edge security if they don't notice 80 million records being accessed. That's like your whole house being emptied out by a thief and only noticing it when they take the lightbulbs.
Click to expand...

Agreed, they should have been able to detect the sysadmin's ID accessing the records and put a stop to it.

They do kind of describe it that way though, so there's that.
 
You must log in or register to reply here.
Back
Top