incident · 1422489600000

Anthem Data Breach

Health insurer Anthem Inc. experienced a data breach exposing the personal information of 78.8 million individuals.

What happened

Hackers gained access to Anthem's network via spear-phishing and exfiltrated a massive database of customer and employee records.

Technical mechanism

Spear-phishing emails delivered malware that established a backdoor, allowing attackers to access and exfiltrate data.

Why it matters

One of the largest healthcare data breaches in history, leading to significant regulatory fines and class-action settlements.

Impact

Exposure of PII for nearly 80 million people, resulting in a $115 million class-action settlement and a $16 million OCR penalty.

Response

Anthem notified affected individuals, offered credit monitoring, and agreed to implement enhanced security measures.

Defensive lessons

  • Deploy advanced anti-phishing controls
  • Implement zero-trust architecture
  • Enhance monitoring for data exfiltration

Evidence register

  1. U.S. Department of Justice — Member of Sophisticated China-Based Hacking Group Indicted for Series of Computer Intrusions (verified)