Anthem Inc.

Packers Sanitation Services, Inc. Ltd. reported a data breach involving its former health insurance provider, Anthem Inc. Hackers gained unauthorized access to Anthem's systems, compromising personal information of approximately 80 million individuals, including PSSI employees. Data exposed included names, SSNs, medical IDs, and employment data. Anthem engaged law enforcement and forensic investigators, offering credit monitoring and identity repair to affected individuals.

Anthem Inc., a health plan based in Indiana, reported to HHS OCR on 2015-02-13 (breach report filed 2015-03-13) that cyber-attackers exfiltrated ePHI for approximately 78.8 million individuals between 2014-12-02 and 2015-01-27, discovered on 2015-01-29. Initial access was via spear phishing of an Anthem subsidiary employee, leading to an advanced persistent threat intrusion. Stolen data included names, SSNs, medical identification numbers, addresses, dates of birth, email addresses, and employment information. Anthem agreed to a $16 million settlement and corrective action plan with HHS OCR to resolve potential HIPAA Privacy and Security Rule violations, including failures in enterprise-wide risk analysis, system activity review, incident response, and minimum access controls dating back to 2014-02-18.

Affected (this filing):

Anthem, Inc. notified California AG that cyber attackers gained unauthorized access to its IT system starting in early December 2014, discovered on January 29, 2015. The breach affected current and former members of Anthem and affiliated Blue Cross/Blue Shield plans. Accessed data included names, DOBs, SSNs, healthcare IDs, addresses, emails, and employment/income data. No credit card or medical claims data was compromised. Anthem engaged the FBI and Mandiant, closed the vulnerability, and provided two years of free identity protection via AllClear ID to affected individuals.

Anthem, Inc. reported a data breach to the Hawaii Office of Consumer Protection. The office was notified on 2015/02.15. Breach type: Hackers/Unauthorized Access. 18,206 Hawaii residents were affected. Recovered from the Internet Archive after the notice was removed from the OCP table.