HackingHealthcareTechnologyHealthcareVulnerability ExploitCapture Stored DataData ExfiltratedTargetedCustomer Data InvolvedIdentity (basic)Government IDEmploymentCriticalContained

ANTHEM INSURANCE COMPANIES, INC.

bd_f4f5ff0eb844cd37 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Jan 29, 2015

Filed

Mar 6, 2015

To disclose

5 weeks

Affected

461,769state residents only

Linked

4 filings

Confidence

66%

Full breach record for ANTHEM INSURANCE COMPANIES, INC. →6 incidents on file

Anthem, Inc. disclosed a cybersecurity incident where cyber attackers gained unauthorized access to its IT system in early December 2014. Discovered on January 29, 2015, the breach exposed personal information including names, SSNs, DOBs, and employment data for current and former members of affiliated health plans and other BCBS plans. Anthem engaged the FBI and Mandiant, closed the vulnerability, and provided two years of identity protection services.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due5 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 59 days

discovery → filing · 5 weeks / 36 days

Dec 1, 2014

Begins

Jan 29, 2015

Discovered

Mar 6, 2015

Filed

vs. sector median

6 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

New Hampshire State AGbd_d4793a610fc324cb2015-03-18 · +12dCandidate
New Hampshire State AGbd_5bb5e58103332c9f2015-03-20 · +14dCandidate
New Hampshire State AGbd_a9c16e6c6be5f1002015-02-18 · +16dCandidate

Name: ANTHEM INSURANCE COMPANIES, INC.
norm: anthem insurance companies
Domain: anthem.com

Name: ANTHEM INSURANCE COMPANIES, INC.
norm: anthem insurance companies
Domain: anthem.com
Industry: HealthcarellmTechnologyllm

Discovered: Jan 29, 2015
Breach occurred: Dec 1, 2014
Undetected for: 59 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 25, 2015
Affected individuals: 461,769state-resident count only
Data types: Identity (basic)Government IDEmployment
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: contacted the FBIfully cooperating with the FBI’s investigation
Initial access: exploit_public_facing

During the incident: Began working to close the security vulnerability
Contacted the FBI
Fully cooperating with the FBI’s investigation
Retained Mandiant to assist in our investigation and to strengthen the security of our systems
Changes made: Provided identity protection services to all individuals that are impacted
Arranged to have AllClear ID protect your identity for two (2) years at no cost
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(36 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 2 states

View merged incident ↗

New Hampshire State AGFeb 18 · first

South Carolina State AG+16d · this page

New Hampshire State AG+28d

New Hampshire State AG+30d

Pattern: first filing Feb 18 (NH), last Mar 20 (NH) — a 30-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/Anthem.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 6, 2015
Raw hash: 13771dd9260772585ad55fe134980fe3f729363c5c4115946680f7b4a6918677

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityANTHEM INSURANCE COMPANIES, INC.

Victim entityANTHEM INSURANCE COMPANIES, INC.

Incidentdiscovered Jan 29, 2015

Stated responseBegan working to close the security vulnerability

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov