Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


05:35 PM
Connect Directly

A Mere 8 Days After Breach, Anthem Healthcare Notifies Customers

Was the data encrypted in storage? Investigators aren't saying, but they hint that it wouldn't matter either way.

In a rare (perhaps unprecedented) move, a large company reported a data breach -- to authorities, the media, and the individuals whose data was stolen -- well before they were legally obligated to do so. Wednesday night, Anthem Healthcare, the nation's second-largest health insurer, began notifying its customers and the media that the personal records of as many as 80 million individuals were compromised -- a mere eight days from when Anthem first detected suspicious activity Jan. 27.

In a statement, Anthem president and CEO Joseph Swedish said, "Once the attack was discovered, Anthem immediately made every effort to close the security vulnerability, contacted the FBI and began fully cooperating with their investigation. Anthem has also retained Mandiant, one of the world’s leading cybersecurity firms, to evaluate our systems and identify solutions based on the evolving landscape."

The initial unauthorized access has been tracked back to Dec. 10. The stolen data includes names, employment data, income data, Social Security numbers, street addresses, email addresses, and medical ID numbers. But investigators say there is no evidence to indicate that medical records (claims, test results, diagnostic codes) or credit card data were compromised.

What is clear is that the attack was extremely targeted: aimed at Anthem specifically, not just any healthcare institution. What is not clear is whether or not the stolen data was encrypted.

According to a security alert issued today by HITRUST:

Anthem has been collaborating with the HITRUST Cyber Threat Intelligence and Incident Coordination Center (C3) since initial discovery of suspicious activity on its network, including sharing of various indicators of compromise (IOCs) consisting of MD5 hashes, IP addresses, and threat actor email addresses.

This crucial observable information was anonymously shared with the HITRUST C3 Community, through the automated threat exchange. It was quickly determined that the IOCs were not found by other organizations across the industry and this attack was targeted at a specific organization.

Upon further investigation and analysis it is believed to be a targeted advanced persistent threat (APT) actor.

Dave Damato, managing director of Mandiant, the organization leading the investigation  into the Anthem breach, confirms "Yes, it was targeted at a specific company." However, the same criminals could carry out similar attacks on other organizations, and just change the indicators of compromise (MD5 hash, IP addresses, domain names, etc.) to make it harder to detect. 

Damato could not share many details about the ongoing investigation, but Adam Meyer, Chief Security Strategist at SurfWatch Labs says, “Anthem discovered the attack when a database administrator noticed unauthorized queries running with admin credentials. Data exfiltration was performed through an external web storage provider 'commonly used by U.S. companies,' which suggests a service such as Google Cloud, Microsoft One Drive, or Dropbox was utilized to reduce chances of detection.”

“Upon discovery," says Meyer, "Anthem reset all passwords with privileged access across their environment and disabled accounts without two-factor authentication. Statements indicating that the company immediately made every effort to close the security vulnerability suggest that a known vulnerability was exploited in the corporate web environment or that a payload was delivered via spear phishing to employees but was easily corrected once identified as the point of entry. Data was exfiltrated to a known cloud storage provider likely utilizing authorized credentials.”   

Damato says that there is no evidence to suggest that an Anthem insider was involved in the breach, so admin credentials were probably stolen by outside attackers.

What remains unclear is whether or not the breached data was encrypted. When asked, Damato's response was itself rather cryptic. What he did say is that the issue with all encryption is that, data has to be decrypted before an authorized user can use the data. So if it could somehow be copied or exfiltrated while it is in use, unencrypted, the fact that it was encrypted while in storage might not matter.

"We are dealing with one of the biggest data breaches in history and probably the biggest data breach in the healthcare industry," says Jaime Blasco, VP and chief scientist of late-stage security startup AlienVault. "If you are wondering what it means for individuals, in a few words: it is a nightmare. If the attackers had access to names, birthdays, addresses and Social Security numbers, it means that information can be easily used to carry out identity theft schemes.

"It is yet unclear who is behind the attack," says Blasco, "but if the group behind that compromised Anthem and plans to sell that information on the black market, it means cybercriminals can buy  access to the stolen data and use that information to drain your bank account, open new credit accounts and telephone accounts or even utility accounts. They can even obtain medical care using your information."

Damato says that his team at Mandiant definitely aims to provide some attribution for the attack, so they can have a better idea of what the attackers will do with the data they've stolen. But, attribution is hard for a variety of reasons. Not only because attackers take pains to obfuscate their identities, but because sometimes an organization has been breached by multiple threat actors, making it "hard to delineate between" them.

"I think the industry as a whole is getting better at attribution," says Damato, "but there's still a lot of noise."

"One thing that's very important and very different," he adds, "is that Anthem reported it before they had to." Damato says it will be very interesting to see what effect that speed has on the investigation and public response.

The responses of customers remains to be seen -- but with the Affordable Care Act's enrollment deadline a mere 10 days away, their opinions may be known quite soon. For their parts, the FBI and the security industry have applauded Anthem for reporting the incident so quickly.

The FBI stated: "Anthem's initial response in promptly notifying the FBI after observing suspicious network activity is a model for other companies and organizations facing similar circumstances."

Damato says that the company reported it so quickly simply because they thought it was the right thing to do.

In his statement, Anthem CEO Swedish said "Anthem’s own associates’ personal information – including my own – was accessed during this security breach. We join you in your concern and frustration, and I assure you that we are working around the clock to do everything we can to further secure your data."

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 2
User Rank: Ninja
2/6/2015 | 2:50:59 PM
Re: Why does it matter if the data was encrypted?
@L174, WHAT!? Where are you getting your information?

The operating system only determines encryption levels (Protocols) if you let it, such as in a Windows Server where encryption can be controlled with a simple registry edit. I'd have to believe that these companies are not allowing this to happen and instead are using add on applications like OpenSSL or some other enterprise level data encryption software. Furthermore, if the data is encrypted you cannot access it without the proper keys for access, unless you have a few super-duper computers and more than a few years to hopefully stumble onto the correct key parings.

Although there may be places in the infrastructure where data may not be fully encrypted such as at the point where the application feeds a DB, but even that is very rare. Even rarer (I hope) would be an unencrypted DB holding sensitive data, hell, or ANY DATA. Any company that does not encrypt data in transit is stupid and deserves to be hacked.

Sensitive data that travels over a network are required to be securely encrypted from the point of data entry to the point where the data is processed if those companies are to be HIPPA, PCI or GLBA compliant.

Your comment leaves me to believe that you are either:

a)      Trolling

b)      Uninformed

c)       Not responsible for security on any level


d)      Negligent

So you said, "Data Encryption is only helpful if a physical harddrive or machine is stolen, period."... what's the difference between a disc-image or the actual HDD? And a hacker isn't going after a HDD or an image because attempting to obtain either will or should set off alerts, he wants the DB and even that is going to be striped across a RAID. From what I remember about RAID, what you suggest is only "possible" if you remove a drive from a RAID – 0 or RAID – 1, and I don't believe Anthem is "Mom & Pop" enough for that configuration.

User Rank: Apprentice
2/6/2015 | 2:18:09 PM
Re: Why does it matter if the data was encrypted?
I hate to be blunt, but your post belies a significant level of ignorance about major-business information security architecture and infrastructure.


Anthem almost certainly does not store production databases on "encrypted disks".

Also, the fact that a "database administrator noticed unauthorized queries" strongly suggests that if the data was encrypted, it's still encrypted and is (to the limits of the encryption strenght) just fine now.


When you understand enough to know why these statements are true, you'll understand why the rest of your post is largely incorrect as well.
User Rank: Apprentice
2/6/2015 | 12:00:44 PM
Why does it matter if the data was encrypted?
Data Encryption is only helpful if a physical harddrive or machine is stolen, period. (Let that sink in for a minute)

While encryption is beneficial it is only usful in about 3% to 5% of data breach situations. (If you want to do a groundbreaking story you should focus on the fact that encryption offers very little protection in a hacking situation.)

Once a hacker has access to a running machine the data has already been decrypted by the Operating System or the running application and it is fully available to the hacker in the same decrypted format.

I will say it again, encryption is only helpful if a physical machine or harddrive has been stolen. So the big question was not "was the data encrypted' but how did the hackers gain access? By the way, I am willing to bet the data in this case was on an encrypted disk and as expected it did not help.
<<   <   Page 2 / 2
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Zero Trust doesn't have to break your budget!
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-06-16
FOGProject v1.5.9 is affected by a File Upload RCE (Authenticated).
PUBLISHED: 2021-06-16
Cross Site Scripting (XSS) in Moodle 3.10.3 allows remote attackers to execute arbitrary web script or HTML via the &quot;Description&quot; field.
PUBLISHED: 2021-06-16
In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS. These SVG files can contain malicious scripts. This file will be uploaded to the system and it will not be stripped or filtered. The user can create a link on the website pointing to &quot;/storage/exp.svg&quot; t...
PUBLISHED: 2021-06-16
D-Link DIR-2640-US 1.01B04 is vulnerable to Buffer Overflow. There are multiple out-of-bounds vulnerabilities in some processes of D-Link AC2600(DIR-2640). Local ordinary users can overwrite the global variables in the .bss section, causing the process crashes or changes.
PUBLISHED: 2021-06-16
D-Link DIR-2640-US 1.01B04 is vulnerable to Incorrect Access Control. Router ac2600 (dir-2640-us), when setting PPPoE, will start quagga process in the way of whole network monitoring, and this function uses the original default password and port. An attacker can easily use telnet to log in, modify ...