In February 2015, Anthem Inc., one of the largest health insurance companies in the US, disclosed that hackers had accessed its database and stolen approximately 78.8 million customer records. The stolen data included names, Social Security numbers, medical IDs, addresses, dates of birth and income information.
The breach was attributed to a state-sponsored hacking group (believed to be Chinese). The hackers gained access through a phishing email that compromised an employee's credentials, then moved laterally through Anthem's network to the database.
Anthem paid $115 million in a class-action settlement — the largest data breach settlement in history at the time. The case illustrated how healthcare data is uniquely valuable to hackers (it cannot be changed like a credit card number) and how a single phishing email can compromise the most sensitive personal data of tens of millions of people.
The breach cost $115M in settlement, the largest ever, because stolen SSNs and medical IDs cannot be changed like credit cards.
Hackers stole 78.8M health records via a phishing email that compromised an employee's credentials.
The stolen data included SSNs, medical IDs and income information — data that cannot be changed.
Anthem paid $115M in a class-action settlement.
The breach was attributed to a state-sponsored hacking group.
Healthcare data is the most valuable data a hacker can steal — because it cannot be changed. A credit card can be cancelled; a Social Security number cannot. The human layer is the weakest link.
Anthem paid $115M and overhauled its security. The case prompted the healthcare industry to strengthen cybersecurity and influenced HIPAA enforcement. It remains one of the largest data breaches in US history.
FOLLOW THE EVIDENCE