11 ms·
Anthem Blue Cross breach notification [pdf]
- SMAAART 5y ago> What are we doing? We changed our password from 1234 to OhMFGwerefucked1234
- hereforphone 5y agoMy insurance company. And NICE! they are offering me free credit monitoring. Only I still have free credit monitoring from the OPM breach where the federal government lost all my personal information to what is probably nation-state level hackers. No consequences, the trend will continue. Consider all of your information compromised, always.
- snapetom 5y agoWith so many data breaches occurring, we all probably have free credit report monitoring for life. It's completely ridiculous. There's zero consequences for bad security. All companies need to do is report the breach to the government, buy "credit monitoring" for the victims which costs pennies, and deal with half a day of bad press on Twitter. Meanwhile, consumers have to deal with identity theft consequences, which in a court of law, is nearly impossible to tie back to a specific incident. Until governments impose serious fines, even to mom and pop businesses scaled up to massive corporations, this will not change.
- kylehotchkiss 5y agoSince everybody already has free credit monitoring, it seems like maybe they should be paid cash for breaches in the future.
- lotsofpulp 5y agoI bet a lot of people would sign up to pay lower premiums in exchange for not having their data be private. I probably would too depending on how much cheaper. People already use GoodRx discount cards at pharmacies.
- jlmorton 5y agoThere's was an option to accept $50 in lieu of credit monitoring last time.
- b9a2cab5 5y agoGood IT and engineering staff is a lot more expensive than even a fine for 10% of your annual revenue. Hiring a single good security engineer might cost 400k or more. Good luck getting your insurance company that pays $100k to senior engineers to do that.
- snapetom 5y agoThat is definitely a key problem. Why pay for even one security professional when the consequences are just a few grand in credit monitoring for your customers?
- perl4ever 5y agoI applied for a programming job with an insurance company once and then the first screening test involved interpreting flowcharts, looked like they were photocopied from a 1970s textbook. I decided then and there it wasn't worth it. >$100k to senior engineers Could be half that and no technical screening whatsoever.
- pettycashstash2 5y agoMost technical operations are outsourced. They even have a separate company in india for obvious cost savings reasons.
- perl4ever 5y agoAnthem specifically? Maybe, but insurance and other mundane companies in general hire Americans for IT jobs, only in places like Indiana, upstate NY, or the southeastern US. Often working with people who are in, say, New Delhi, but not being replaced by them. Outsourcing frequently means outsourcing to people in the US who are paid enough less to be a logical option.
- kingcharles 5y agoI need to buy shares in credit monitoring companies. It's the industry of the future!
- disabled 5y agoA lot of countries have solved this problem. I am a dual US|EU (Croatian) citizen. On the EU side, we have smart chip national ID cards that are being adopted EU-wide. In Croatia, you can use those smart chip national ID cards for governmental affairs with a USB smart chip reader (for authentication) on the e-citizens portal.
- philwelch 5y agoThere’s a requirement that buildings need to have building plans that are personally approved and vouched for by a credentialed Professional Engineer, who takes personal liability—up to and including criminal liability for negligent homicide—if the building collapses and harms people due to a design flaw. I think that’s a good model for this type of problem.
- EricE 5y agoYes - computer "science" is a joke. I'm certainly not one for rampant regulation, but this is an area that needs to get seriously beefed up. Especially with the right systems far more people can be harmed than by a building collapse :p
- hereforphone 5y agoComputer science is a real science and is fine. It is not however engineering. Anyway, the problems lie in the information security industry, which is amateur in comparison.
- throwawayboise 5y agoYes, corporate IT is basically equivalent to 1800's era factory technology. It works, but there are massive safety issues.
- hulitu 5y agoThe technology is there. You just have to use it. It does not help however, that the most popular mobile and desktop OSs make money with your data which leads to absymal security practices.
- maccolgan 5y agoPerhaps it's indeed time for serious companies (these are definitely not MVPs) to have security insurance and they'd mandate some standard.
- perl4ever 5y ago>identity theft consequences >Until governments impose serious fines Or maybe change the language? It's not possible to steal an identity; it's a fiction that is convenient for corporations handling personal information in ways that cost society.
- floatingatoll 5y ago"Anthem Blue Cross is the trade name of Blue Cross of California" is why this is (ca.gov).
- newfonewhodis 5y ago> What are we doing? > We: > • Looked into what caused this issue. > • Are taking steps to reduce the risk of this happening again. > • Temporarily shut down the portal account So, they cheap out on security, cause MY PII to be leaked (enough for identity theft) and all they do is shut my own access out? No details on "Are taking steps to reduce the risk of this happening again" because I bet all they did was shut off this one hole rather than revamp their security. For the record, this isn't even the first Anthem BC breach: In 2015, they had a breach so large that it has its own Wikipedia page. https://en.wikipedia.org/wiki/Anthem_medical_data_breach https://en.wikipedia.org/wiki/Anthem_medical_data_breach In 2020, Anthem had net income of $4.57 billion. If they are fined at/settled for the same level as the 2015 breach (~$150M), then their incentive is to continue playing fast and loose with data rather than invest in sane security.
- ceejayoz 5y agoTime to rename that Wikipedia page, I suppose.
- avgDev 5y ago> • Are taking steps to reduce the risk of this happening again. Bob I want you to find me the best(cheapest) security contractor you can find. Few moments later......Sorry, we had another breach, we had one of the best security experts in the world look over our systems and made appropriate changes. We increased our security budget from $5 to $5.01. Have you checked out our corporate events? Those are really fun and we really go all out for our employees.
- crate_barre 5y agoAccenture here, we are prepared to do your bidding.
- adolph 5y agoAnthem has agreed to pay $115 million to settle a class-action lawsuit following a 2015 data breach that exposed nearly 80 million patient records. https://www.fiercehealthcare.com/privacy-security/anthem-agrees-to-115m-settlement-over-2015-data-breach https://www.fiercehealthcare.com/privacy-security/anthem-agr... f) Attorney Fees and Costs. Plaintiffs will also separately petition for an award of attorneys’ fees and reimbursement of litigation expenses from the Settlement Fund. Plaintiffs will not seek more than 33% of the Settlement Fund ($37,950,000) for attorney fees, which as counsel pledged at the onset of the litigation will amount to considerably less than 1.75 times their reasonable lodestar, already reduced in the exercise of billing judgment. Cervantez Decl. ¶ 18. They will also will not seek more than $3,000,000 in expense reimbursements, and will support their application with detailed lodestar information and an accounting of their expenses. Id. ¶ 19. Defendants have agreed not to oppose Plaintiffs’ application https://s3.amazonaws.com/assets.fiercemarkets.net/public/004-Healthcare/external_Q22017/Mot_Prelim_Approval_Doc_869+(1).pdf https://s3.amazonaws.com/assets.fiercemarkets.net/public/004...
- morpheuskafka 5y ago> We have no reason to believe that someone will misuse your information because of what happened. Uh, why do they think someone would illegally access information? Just for fun?
- crankypirate 5y agowhere is the official notification of the breach?
- y-c-o-m-b 5y agoAgain?! They had a huge breach a handful of years ago too. On a somewhat related note: I don't think Aetna is too far behind. Their website is just as awful as Anthem and as a software dev myself, I know that if you don't put care into your consumer-facing products, your security is probably really poor.
- drewg123 5y agoSo the breach involved their portal. I HATE those portals. I wish healthcare providers would just send an email, rather than "you have a new message on our portal". I think (hope?) my email is more secure than these portals..
- somethoughts 5y agoYes I wish there was a way to opt out and just rely on phone support. At least with phone support the attackers would have to social engineer things at an individual records level versus just being able to brute force huge bulk data records out.
- JshWright 5y agoMost doctors offices are effectively overworked and understaffed small businesses. Shifting all that support to the phone would not be reasonable, from a workload perspective.
- curryst 5y agoJust to expand on that, patients aren't the only ones with a legitimate reason to access that data. Insurance companies need copies as well, so they would still want some kind of mass-data portal even if customers don't use it. If you change doctors, they want copies of your old medical records. If you see a specialist, if you go to the hospital, etc, etc. Pharmacies might call and ask if they think there's something weird about a prescription. Direct patient contacts are a vanishingly small percentage of records requests for a doctor. Doctors could likely handle those via phone, but it doesn't solve the issue of needing an EMR.
- Skunkleton 5y agoTechnically, your email may have been transmitted in plain text over the open internet. Most email doesn't go through unencrypted connections, but it isn't guaranteed. Email also doesn't do much to establish the authenticity of the sender, at least not as part of its specification.
- 5y ago
- Rebelgecko 5y agoIs there any more info about the scope of the breach? from the PDF metadata I'm wondering if it only affected people on Medi-Cal in certain counties
- bhaile 5y agoAnthem had another breach in 2015 [1]. Offered free credit monitoring then as well. They were sued and settled in 2017 [2]. [1] https://resources.infosecinstitute.com/topic/the-breach-of-anthem-health-the-largest-healthcare-breach-in-history/ https://resources.infosecinstitute.com/topic/the-breach-of-a... [2] https://www.businessinsurance.com/article/00010101/NEWS06/912314090/Anthem-to-pay-record-$115M-to-settle-lawsuits-over-data-breach https://www.businessinsurance.com/article/00010101/NEWS06/91...
- JumpCrisscross 5y agoTwo years' credit monitoring plus, for "people who are already enrolled in credit monitoring...up to $50 per person." That looks like B.S. to me. But were I to play devil's advocate, I'd have to point out that the evidence of actual damage done is slim.
- adrianmonk 5y agoI'm getting a 404 response and this message; > The requested page "/system/files/ca%20hitech%20dtn%201020172.pdf" could not be found. EDIT: Now I'm not, and I can load the PDF. Not sure why.
- alx__ 5y agoDid the file move? Am getting file not found for: https://oag.ca.gov/system/files/CA%20HITECH%20DTN%201020172.pdf https://oag.ca.gov/system/files/CA%20HITECH%20DTN%201020172....
- mdaniel 5y agohttps://oag.ca.gov/ecrime/databreach/reports/sb24-547906 https://oag.ca.gov/ecrime/databreach/reports/sb24-547906 is the metadata record for it, which links to https://oag.ca.gov/system/files/CA%20HITECH%20DTN%201020172.pdf https://oag.ca.gov/system/files/CA%20HITECH%20DTN%201020172.... I found that via the whole list: https://oag.ca.gov/privacy/databreach/list https://oag.ca.gov/privacy/databreach/list
- jeffparsons 5y ago> Up to $1 Million Identity Theft Insurance: Provides coverage for certain costs and unauthorized electronic fund transfers. Why is this needed? If my bank erroneously decides to let somebody else transfer funds out of my account, or lets somebody else establish a debt in my name, then that's just a bank error. Is my bank not liable for that?
- FateOfNations 5y agoWhile the bank may be liable at the end of the day, you very well may have to sue to get them to accept liability, and lawyers cost money. The insurance pays for the lawyers.
- voganmother42 5y agoMitchell and Webb did a great riff on this: https://youtu.be/CS9ptA3Ya9E https://youtu.be/CS9ptA3Ya9E
- disabled 5y agoCan’t wait for the medical device hacks coming soon! I recently was admitted to an American hospital due to sepsis for an extended period of time, when I was visiting family for a few months (fortunately I am insured in the United States even while abroad). The hospital required the nurses to administer IV meds in a very peculiar way. One week into my hospital stay, they started a new programme administering IV meds with code executed from the Electronic Health Record (Epic) to the pump. The pump would start as soon as the barcodes for the IV meds were scanned. The infusion rates were programmed into the electronic health record so the nurses didn’t have to manually program the pump.
- dec0dedab0de 5y agoI spent a bunch of time in the hospital over the last 2 years, and my hospital did the same switch. The nurses hated it, and they all knew how to override it if it didn't work correctly.
- primitivesuave 5y agoFor every disclosed HIPAA violation, there are at least 10x the number of violations that go unnoticed and unreported. When you give data to a hospital or clinic, it is being shared in unredacted form with third parties that have signed Business Associate Agreements with the healthcare provider. There is no oversight or concrete regulation that comes with a BAA, there is no "HIPAA inspection" similar to an OSHA or FDA surprise inspection, while the ramifications of leaking your health data have become far more consequential (to the point that you might need to pay into the Experian protection racket when it happens). Source: I work in the industry.
- sfink 5y agoI have a portal account that my (autofilled!) password wasn't working for. I contacted the doctor's office, and they sent me back the plaintext password. That's when I knew.
- primitivesuave 5y agoThis is the perfect anecdote. Either you get lucky with a healthcare provider that has signed a BAA with a company where someone happens to know how to use bcrypt for passwords, or you don't - there is really no way to know until you send that password reset email.
- perl4ever 5y agoI logged on to a medical practice's portal and was able to access all of the provider's notes from my visits. I didn't read them or investigate to see whether it was just my own that were available, but I'm pretty sure it was a mistake in setting permissions. Some time later the whole portal disappeared, except for a bill pay page. Also the provider suddenly quit with no warning; I don't recall the sequencing. Nobody ever sent me a letter fessing up to anything.
- JshWright 5y agoThe provider's notes about your visit are part of your medical record, and something that would be very reasonable for you to see (in most cases they are legally required to provide access to your compete record). What would they need to "fess up" about?
- dreamcompiler 5y agoUntil CEOs start going to jail for this stuff, it's prudent to expect every company you do business with will soon lose all your personal information to a bad guy. If the company makes an especially big deal about "protecting your personal information," expect it to happen even sooner.
- vlovich123 5y agoI don’t think that’s a good answer. It “feels good” but won’t solve any problem - do you really think security breaches will vanish because we will send the CEO to jail? I think instead what we need to do is: A) have “egregious” problem multipliers that stack. Using outdated cryptographic designs? 10x damages multiplier. Using software with known vulnerabilities that was part of the breach? 100x multiplier. Not encrypting data at rest? 1000x multiplier. Etc etc. B) develop a standard whereby my PII is not allowed to be stored and you only get access to it at time of use (this would also largely solve the problem of the shadow data marketplace). Even with all that, you could have a security breach where someone has a Trojan spying on all traffic live on the system and stealing that PII once it’s decrypted. So the problem isn’t solvable but maybe these kinds of steps might raise the bar.
- throwawayboise 5y agoBasically, anyone who maintains a database of information needs to be liable for damages due to the disclosure and/or inaccuracy of that information. Trial lawyers will take care of the rest.
- bigyellow 5y agoThe whole point of incorporating is to limit personal liability. This vengeful "put CEOs in jail" attitude flies in the face of law and even common sense, and doesn't address the root of the problem, which is tech-illiteracy in the general population, not evil men in white collars.
- torstenvl 5y agoIncorporation limits liability of the shareholders. Nobody is talking about liability for shareholders.
- brutal_chaos_ 5y ago> We have no reason to believe that someone will misuse your information because of what happened. Yeah, ok. They literally sent victims to a DATA BROKER to "protect" them. The very same people who would buy up that leaked data that came the "hack." What fucking world do we live in?? Edit: ...
- throwawaysea 5y agoI'm sure many people here have been the victim of repeated security breaches. I feel like all the criminals have my info already. The best I can do from my end is compartmentalize risks by using different email addresses, phone numbers, logins, and passwords everywhere. But it isn't practical to do that either (particularly with phone numbers). We need to solve that problem, and we need to introduce actual fines and jail time for these breaches.
- brutal_chaos_ 5y agoFree credit monitoring is the biggest scam of all: - Company doesn't follow security practices and leaks data - Feds get notified if it's a big enough breach. Btw, this is from the good will of the company - Data Brokers...erm, Credit Agencies, then monitor for the data...i guess the insurance company sent it to them too, so they know what to look for? - I don't know who pays for this (originating company, tax payers, etc) - Credit Agencies now get to monitor you. Watch what you do under the guise of protecting you. While still building your credit score. - Hopefully the info leaked and being used is accurate. If not, the Credit Agency has no obligation to fix it unless you say so and even then it can take a long time to remedy. This just seems fucked.
- chris37879 5y agoI have a creditor that reported a bogus charge. The source of the charge is an illegal clause in their contract, when I tried to get the charge removed from my credit report, they sent back as proof the final page of the document with my signature (not even the page with the clause in question) and that was apparently enough to validate the debt? So because I had signed _something_ for them, the debt was assumed to be valid. It's now at the point where the only means I have to remove it from my report is to sue them.
- perl4ever 5y agoThe last time I went to urgent care and then to the hospital, they had me sign for things on an electronic pad with no text presented or available. Ha, now that I think of it, they probably had signs saying no recording and/or turn off your phone, so I may not have even been permitted to record what they said.
- bigyellow 5y agoUnless such signs carry force of law where you live (I don't know of any such jurisdiction), always record conversations that take place in public settings.
- throwawayboise 5y ago
- dalrympm 5y agoI'm not surprised to find out they were breached I was trying to do a SEP around that time and finally gave up because their system was so broken. At least this explains the Apple ID reset requests I was getting in October!
- trynewideas 5y agoJust quit a job (for other reasons, but that was a yellow flag if not a red one) that had just switched mid-term to Anthem so I'm personally feeling super great about this.
- hifriends 5y agoThis was a pretty small breach if its the same one reported here: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf 2023 individuals affected.
- pcarolan 5y agoThe fine should be $100 per user and go directly to the user. Some companies would just pay it but most would take this more seriously.
- kelseyfrog 5y agoIt should double every time.
- Trisell 5y agoI’ve worked inside of these companies. It’s not just a money issue. It’s a competency issue. These companies are at least 10+ years behind in everything tech. They still believe in firewall moats. Flat networks. They have PHI spread across dev test and production environments. Upper management views tech as a cost center that never produces. They can’t keep talent around because they refuse to pay market rates. And most of their employees and manager have been around 20 plus years, which they applaud longevity, and anybody who attempts to come in and do something new and secure is derided as a hipster who isn’t into security. I knew of 5 different ways I could have exfiltrated the entire PHI of every member without them having any knowledge of it and the SecOps manager just ignored it because they were “to busy”. Throw in archaic security requirements passed down from the BCBSA that do nothing to actually improve security but generally make it harder to work and you have a recipe for disaster.
- MrDunham 5y ago> They can’t keep talent around because they refuse to pay market rates The former CTO of Blue Shield of California told me back in 2012 (re tech talent): > “We have the Ds and the Fs of the industry. I mean, who would want to work for a payor (insurance co) in SF?” (Quoted to the best of my memory… But the first sentence is pretty much verbatim)
- tgsovlerkhgsel 5y agoIf they actually treated their IT team as valuable staff members and not a cost center, and paid market rates, I'm sure they wouldn't have trouble finding talent.
- code_biologist 5y agoThe point made in other threads is that it's way cheaper to just pay token amounts when security breaches happen, rather than pay market rates. They don't want expensive talent.
- pizza 5y agoKinda galling to realize that some of the most personal information of millions of people is being guarded by the D's and F's of the industry.. They ever heard of "First, do no harm?"
- tgsovlerkhgsel 5y agoI find it astonishing that they're allowed to claim We have no reason to believe that someone will misuse your information because of what happened This information would be sufficient to pass identity checks for phone calls at most non-finance companies I've interacted with, including all healthcare providers.
- gurchik 5y agoCame here to say the same thing. If the public actually believed this then Anthem would have no reason to provide credit monitoring.
- afrcnc 5y agoOnly 5k impacted, per the HHS