Anthem Breach May Have Started in April 2014

http://krebsonsecurity.com/2015/02/anthem-breach-may-have-started-in-april-2014/

by wglb • 11 years ago

91 57 11 years ago

mattlong• 11 years ago

Is the 80 million stolen Social Security numbers figure quoted in this article accurate? I had no idea it was so high...that's 25% of the population of the US!

aero142• 11 years ago

At some point, I think we just have to stop pretending that SS numbers are a secret piece of information. Maybe we should just publish them all and be done with it.

revisionzero2• 11 years ago

SS Numbers are definitely becoming increasingly problematic. I don't know if public disclosure is the solution, but within the next 10 years some major changes will need to be enacted.

cmiles74• 11 years ago

IMHO, these companies (and a lot of people) are pretending that social security numbers will be treating with extra care. Clearly, this is not the case.

fargolime• 11 years ago

Imagine how interesting this is going to get. You call up some bank to plead with them that you're the real you, the loan wasn't your doing, and the person you're talking to, who's disbelieving you, just spent their morning on the other end of the stick.

jameshart• 11 years ago

Precisely: identity management is a house of cards. It actually seems, at this point, completely indefensible for the credit system to rely on name, SSN and address as identifiers, since there's really no guarantee that the person who ran out on a loan over here who claimed to have that name/SSN is the same as the person over here who is applying for a mortgage who supplies the same name/SSN.

If a bank got screwed on a loan deal by someone, and all they have to claim it was youis that the person told them your name and SSN? Really, at this point, with so many SSNs leaked, how can they justify blacklisting you with a credit check bureau?

I think you're right. Publish them all. Force banks to come up with a better solution.

sprkyco3• 11 years ago

SSN's are not considered secret pieces of information you could easily publish all SSN's loop{ xxx-xx-xxx//following ssn format }

However, when they are tied in with other identifying information this is when they become unique identifiers. The more associated information that is tied to the SSN the "more secure" the mechanism of identification is. I have noticed this proposal of just not using SSN at all and incorporating something else. An alternative is the password which has been proven to not be the best case scenario as users pick easy passwords to remember. Then 2fa become popular and is becoming much easier to use. Then there were gaps in the sms or voicemail method of 2fa. My point being that no matter the mechanism put into place to uniquely identify an individual there is no silver bullet. The more layers a company adds on the better. Not to say I support HIPPA or any other archaic legislation (PCI etc) these organizations are tasked with instituting laws or guidelines that are being outdated as fast as they are implemented and are required to make it as reasonable for every entity that is covered under these laws.

dredmorbius• 11 years ago

SSNs are identifiers but not authenticators.

The benefit to use of SSNs is that they're assigned by a central authority which does a pretty good (though not perfect) job of ensuring that there's a 1:1 correspondence of SSN to person.

The issues of how they were to be used _other_ than by the Social Security Administration has been up in the air for a long time. I remember in college when "student identifiers" were just SSNs, and grades and other student data would be posted on office doors by Student ID (that is: SSN). That started getting phased out in the 1990s. There's the matter of the namespace -- it was kept intentionally small, and SSN exhaustion is something that will be faced eventually -- the space is sufficient for "several generations", some 450 million have been issued. The total namespace is around 890 million numbers.

The problem is that when you sign up for new services (online, financial, other), there's a desire though often not a specific need, to associated an account with a specific person. And so the SSN gets drafted to serve that purpose, as a proof of identity, not as an identifier based on other proven identity.

It's a misuse of the identifier

Spooky232• 11 years ago

It's not just Anthem, it's potentially anyone in the BlueCross network.

ambler0• 11 years ago

Could you please explain this comment? (I apologize if it is addressed in the article, which I have only been able to quickly skim since I'm at work)

revisionzero2• 11 years ago

Does anyone know why Anthem's clients have not been notified, at all, yet?

I am part of Anthem and I have heard literally nothing directly about this, it's all been through news/tech sites.

tjbiddle• 11 years ago

I received an email last week - maybe check your spam?

jstalin• 11 years ago

I received one as well.

troisx• 11 years ago

Anthem said they wouldn't be sending emails, so that may have been a scam:

"Members who may have been impacted by the cyber attack against Anthem, should be aware of scam email campaigns targeting current and former Anthem members. These scams, designed to capture personal information (known as "phishing") are designed to appear as if they are from Anthem and the emails include a "click here" link for credit monitoring. These emails are NOT from Anthem."

zaphar• 11 years ago

Anthem has stated that they will not be calling or emailing clients and you should check their site http://AnthemFacts.com for updates. (why that site is not protected by ssl I have no idea)

If you do get contacted personally it's a safe bet it's a phishing attack.

Our Company is affected and all our interaction has been through HR. I would contact your HR department.

ubernostrum• 11 years ago

Well, you need to correct this a bit.

Anthem will not be emailing individuals, but apparently will be sending a snail-mail packet of information including an offer for credit-monitoring services. And they have been contacting, via email, the benefits/HR people of client companies which used Anthem for group health plans for their employees.

(that all comes via my employer, which has been sending me updates about this)

jordanthoms• 11 years ago

That site is strange - they have a big box saying that no medical or credit card data was compromised, then buried in the body text we find out that "These attackers gained unauthorized access to Anthem’s IT system and have obtained personal information from our current and former members such as their names, birthdays, medical IDs/social security numbers, street addresses, email addresses and employment information, including income data. "

CC numbers are far less important than any of those identifiers - unlike your SSN or address, they're easy to change. Someone with all that info can just apply for their own CC or loan in your name...

jonlucc• 11 years ago

My wife's company uses Anthem, and they've been notified by their HR department that they are part of the breach, but that is all they know for now.

jamra6• 11 years ago

Their email stated that they would contact those who have been breached. It appears that everyone was breached. I think that means that they will try and hide the care package (1 year of free credit monitoring) in snail mail so they don't have to pay out.

I already locked my credit and now I'm thinking it's time to freeze my credit so no one can take out new lines without me unfreezing it or increased authentication.

I am learning how this is all working, but if you think about it, it's silly to wait for a breach to have your data locked down.

uptown• 11 years ago

How do you lock and freeze your credit?

zobzu3• 11 years ago

got notified twice by anthem (email) and once by company (hr got contacted by anthem) but they still havent confirmed if my data has been disclosed (obviously, i suppose it has)

x0x0• 11 years ago

I got notified by anthem.

subject line:

   Important Update from Anthem, Inc.

And the first paragraph is:

   Safeguarding your personal, financial and medical information is one of our 
   top priorities, and because of that, we have state-of-the-art information 
   security systems to protect your data. However, despite our efforts, Anthem 
   Blue Cross was the target of a very sophisticated external cyber attack. 
   These attackers gained unauthorized access to Anthem’s IT system and have 
   obtained personal information from our current and former members such as 
   their names, birthdays, medical IDs/social security numbers, street 
   addresses, email addresses and employment information, including income 
   data. Based on what we know now, there is no evidence that credit card or 
   medical information (such as claims, test results or diagnostic codes) were 
   targeted or compromised.

So yeah, safeguarding is apparently not that much of a priority.

This from a fucking company that uses an online payment system that limits your password to 8 characters.

sprkyco3• 11 years ago

This may be a blessing in disguise as it seems that a deluge of phishing attacks ensued, obviously, after this announcement. Whether or not the attacks are directly attributed to leaked information or the attributed party. Be vary wary of any emails that anyone does or has received.

abarringer• 11 years ago

Our HR department sent out a notice that had been passed down from Anthem.

Today we received a second notice warning of phishing scams that was passed down from Anthem.

jfc• 11 years ago

As long as U.S. laws fail to impose significant costs for data security breaches, we can expect companies to treat the costs of these breaches as the cost of doing business--just as they do with litigation costs for faulty automobile parts, manufacturing pollution, and the like.

aestetix• 11 years ago

Isn't this the type of scenario HIPAA is supposed to cover?

jamra6• 11 years ago

It is. HIPAA should destroy these jerks. The problem is that they are stating that no health data was actually lost... just the part of the health data that identifies you and can be used to ruin your credit.

Since that part of the data should be the most locked down, it seems like a complete lie to me. I think the health info was compromised completely.

zobzu3• 11 years ago

even in tech companies (even Google) security is handle like that

uxp• 11 years ago

I doubt Google-esque companies would store a users table with foreign keys to social security numbers, street addresses and phone numbers unencrypted (FDE does not count as it's for hardware loss, not data loss) or at least without some kind of base-level ACL, but I would love to be surprised.

Much of the data I presume that Google deals with is not sensitive enough to warrant the kinds of encryption that a health provider company should use. My search data and even my Google+/YouTube/Gmail accounts are enough to tie them to my person, but not my identity. I, or someone masquerading as me, cannot open a line of credit with my Google account at a bank.

groby_b• 11 years ago

And you know that because you've worked at which large tech companies, exactly?

0xdeadbeefbabe• 11 years ago

U.S. laws, estimable and glorious as they are, can't begin to fix a global problem like this.

Lawtonfogle• 11 years ago

Any such law would be used to squash small businesses while larger ones are largely given a pass (even a fine large enough to sting will only sting). See the difference between dealing with known drug money as an individual vs. as a bank.

detaro• 11 years ago

Then tie it to the company size, or make it big but limit it according to some factor (As far as I remember, here in Germany it limited by a percentage of revenue). And/or add personal liability for people having oversight over this, of course also within limits.

ecopoesis• 11 years ago

In Massachusetts, 201 CMR 17.00 sets a $5000 per violation fine for losing personal information. The law itself is poorly written, so it's unclear if a violation is per individual, or per incident. I would love to see it enforced per individual, and for our AG to go after and destroy Anthem, and all the other companies that keep getting away with this.

If enough companies are destroyed, eventually they will start taking security seriously.

Anthem Breach May Have Started in April 2014

Related Stories