On February 4, 2015, Anthem disclosed that criminal hackers had penetrated its systems and potentially stolen data on more than 37.5 million people; by February 24, the company revised the figure to 78.8 million. The intrusion began around February 18, 2014, according to a later investigation, and affected multiple Anthem brands. Exposed records included names, birth dates, medical identification numbers, Social Security numbers, addresses, email addresses, employment details, and income information. Anthem said medical and financial treatment data were not compromised, but the stolen identifiers created long-term identity-theft risks.
An investigation by state insurance commissioners concluded that an attacker whose identity was withheld, likely acting at the direction of an unnamed foreign government, had carried out the breach. The review found Anthem’s pre-breach protections had deficiencies but were not unusual for a company of its size, while federal officials determined that the insurer had failed to implement adequate measures to detect hackers harvesting passwords. The Department of Health and Human Services reached a $16 million HIPAA settlement with Anthem, then the largest such settlement, requiring a risk assessment and cybersecurity remediation under federal oversight. Roughly 100 private lawsuits were consolidated, and Anthem agreed in 2017 to a $115 million settlement without admitting wrongdoing; Judge Lucy Koh later reduced requested attorneys’ fees from $38 million to $31 million.
