US health insurer hit by massive breach
Health insurer Anthem, which has nearly 40 million US customers, said yesterday hackers had breached one of its IT systems and stolen personal information relating to current and former consumers and employees.
The number two health insurer in the US said the breach did not appear to involve medical information or financial details such as credit card or bank account numbers.
The information accessed during the "very sophisticated attack" did include names, birthdays, social security numbers, street addresses, e-mail addresses and employment information, including income data, the company said.
Anthem said that it immediately made every effort to close the security vulnerability and reported the attack to the FBI. Cyber security firm FireEye said it had been hired to help Anthem investigate the attack.
The company did not say how many customers and staff were affected, but the Wall Street Journal earlier reported it was suspected that records of tens of millions of people had been taken, which would likely make it the largest data breach involving a US health insurer.
Anthem had 37.5 million medical members as of the end of December.
"This attack is another reminder of the persistent threats we face, and the need for Congress to take aggressive action to remove legal barriers for sharing cyber threat information," US Rep Michael McCaul, a Republican from Texas and chairman of the Committee on Homeland Security, said in a statement yesterday.
The FBI had warned last August that healthcare industry companies were being targeted by hackers, publicising the issue following an attack on US hospital group Community Health Systems that resulted in the theft of millions of patient records.
Medical identity theft is often not immediately identified by patients or their provider, giving criminals years to milk such credentials. That makes medical data more valuable than credit cards, which tend to be quickly cancelled by banks once fraud is detected.
Security experts say cyber criminals are increasingly targeting the $3 trillion US healthcare industry, which has many companies still reliant on aging computer systems that do not use the latest security features.
Anthem said it would send a letter and e-mail to everyone whose information was stored in the hacked database. It also set up an informational Web site, www.anthemfacts.com, and will offer to provide a credit-monitoring service.