The Anthem logo hangs at the health insurer’s corporate headquarters in Indianapolis on Feb. 5, 2015. Hackers broke into the company’s database storing information for about 80 million people in an attack bound to stoke fears many Americans have about the privacy of their most sensitive information. BlueCross and BlueShield of Georgia members are among those whose personal information has now been compromised after cyber- attackers “executed a very sophisticated attack” on the insurer’s parent company, Anthem.
Hackers broke into an Anthem database that contained sensitive information for 80 million people nationwide. That includes BlueCross and BlueShield of Georgia members and employees who are currently covered, or who have received coverage in the past, a statement from the company said.
NEED HELP
Anthem has created a website, www.anthemfacts.com, where members can access information, about the breach. There is also a dedicated toll-free number that both current and former members can call if they have questions related to the cyberattack. That number is: 877-263-7995.
Anthem, which is the nation’s second-largest insurer, said it has yet to find any evidence that medical information like insurance claims or test results was taken, and that credit card information was not compromised. But the hackers did obtain members’ names, birthdates, Social Security numbers, email address, employment details, incomes and street addresses.
Anthem sells mainly private individual and group health insurance, plans on the health care overhaul’s public insurance exchanges and Medicare and Medicaid coverage. The federal government also is investigating whether the personal information of Medicare and Medicaid beneficiaries was stolen.
Blue Cross of Georgia said Thursday it will individually notify current and former members whose information has been accessed, and that credit monitoring and identity protection services will be provided free of charge
Meanwhile, BlueCross BlueShield of Tennessee officials stressed on Thursday that it was a separate company, “with completely distinct operations and information systems.”
While Blue Cross Blue Shield Association includes companies nationwide, they operate independently of each other and includes publicly traded companies like Anthem, as well as state-based or regional companies like the Chattanooga-based BlueCross BlueShield of Tennessee.
“We want to stress that BlueCross BlueShield of Tennessee’s information systems and member data were not directly attacked,” said spokeswoman Mary Danielson.
But the company says members who received care in one of the states affiliated with Anthem plans – including Georgia – may need to take extra precautions.
“Based on what we know now, if any of our members received care in one of 14 states with affiliated Anthem health plans, it is possible that some of their personal data may have been stolen in the criminal act against Anthem.”
Danielson said the company is taking “additional precautions” to secure members’ health information and that the company is “closely coordinating with Anthem to ensure that any of our members whose information may have been exposed will be offered credit monitoring and identity repair services.”
BlueCross BlueShield of Tennessee was the victim of a data breach in 2009, when 57 hard drives were stolen from the company’s East Gate call center BlueCross spent $17 million on the investigation following the breach, and $1.5 million in federal penalties for compromising over a million members’ personal information. Though there is no indication any data from that attack was ever used, the culprits of the attack have never been arrested or prosecuted.
The most recent attack also wasn’t Anthem’s first security breach, according to The Associated Press.
In 2013, the insurer agreed to pay $1.7 million to resolve allegations it left the information of more than 612,000 members available online because of inadequate safeguards. The U.S. Department of Health and Human Services said that security weaknesses in an online application database left names, birthdates, addresses, telephone numbers, Social Security numbers, and health data accessible to unauthorized users.
It may take some time for Anthem to determine which members have been affected by the breach. The exact number of those affected has not yet been determined.
On Friday, Anthem CEO Joseph Swedish, whose personal information was among the data accessed in the attack, apologized to members over the company’s website.
“We will continue to do everything in our power to make our systems and security processes better and more secure, and hope that we can earn back your trust and confidence in Anthem,” said Swedish.
The Associated Press contributed to this report. Contact staff writer Kate Belz at kbelz@timesfreepress.com or 423-757-6673.