Anthem Inc.

Anthem Inc., a health plan based in Indiana, reported to HHS OCR on 2015-02-13 (breach report filed 2015-03-13) that cyber-attackers exfiltrated ePHI for approximately 78.8 million individuals between 2014-12-02 and 2015-01-27, discovered on 2015-01-29. Initial access was via spear phishing of an Anthem subsidiary employee, leading to an advanced persistent threat intrusion. Stolen data included names, SSNs, medical identification numbers, addresses, dates of birth, email addresses, and employment information. Anthem agreed to a $16 million settlement and corrective action plan with HHS OCR to resolve potential HIPAA Privacy and Security Rule violations, including failures in enterprise-wide risk analysis, system activity review, incident response, and minimum access controls dating back to 2014-02-18.