Anatomy of a Breach

Anatomy of a Breach: Anthem — 78.8 Million Health Records and the Largest Healthcare Breach in History

> series: anatomy_of_a_breach —— part: 074 —— target: anthem_inc —— records: 78,800,000 —— attacker: deep_panda<span class="cursor-blink">_</span>_

Hedgehog Security 28 February 2015 13 min read

78.8 million health records. The largest healthcare breach in history.

On 4 February 2015, Anthem Inc. disclosed that it had been the victim of a cyberattack that compromised the personal information of approximately 78.8 million current and former members and employees — making it the largest healthcare data breach ever reported. The stolen data included names, dates of birth, Social Security numbers, medical ID numbers, addresses, email addresses, and employment information — everything needed for comprehensive identity theft.

The breach was attributed to a Chinese state-sponsored group known as Deep Panda (APT19), which had gained initial access through spear-phishing emails targeting Anthem employees. The attackers used stolen credentials to access the company's data warehouse and exfiltrated the records over several weeks. Anthem's CEO discovered the breach on 27 January 2015 after noticing a suspicious database query running under his own credentials — credentials that had been compromised without his knowledge. Anthem ultimately paid $115 million in the largest data breach class action settlement at the time.


Recommended

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Why health data is the most valuable data on the dark web.

Healthcare records are more valuable on the dark web than credit card numbers — a stolen health record can sell for $50-$100 compared to $1-$5 for a credit card. The reason: health records contain the comprehensive personal information needed for long-term identity theft (Social Security numbers, dates of birth, addresses), medical fraud (filing false insurance claims), and cannot be easily changed (unlike a credit card number, you cannot get a new Social Security number or date of birth).

Healthcare Is a Prime APT Target
The Anthem breach — attributed to a Chinese state-sponsored group — demonstrated that healthcare organisations are targets for nation-state espionage, not just financial criminals. The stolen data could be used for intelligence gathering, identifying individuals for recruitment or blackmail, or building comprehensive profiles of US citizens. Our <a href="/blog/sector-under-the-microscope-healthcare">healthcare sector analysis</a> examines the full threat landscape.
Spear-Phishing — The Universal Entry Point
The Anthem breach began with phishing — the same entry vector behind <a href="/blog/anatomy-of-a-breach-rsa-securid">RSA</a>, <a href="/blog/anatomy-of-a-breach-target">Target</a>, <a href="/blog/anatomy-of-a-breach-jp-morgan-chase">JP Morgan</a>, and <a href="/blog/anatomy-of-a-breach-ebay">eBay</a>. Our <a href="/penetration-testing/social-engineering">social engineering assessments</a> test staff resilience to the emails that begin every major breach.
Data Warehouse Accessed Without MFA
The attackers used stolen credentials to access the data warehouse containing 78.8 million records. MFA on the data warehouse would have prevented the stolen credentials from being usable. <a href="/cyber-essentials">Cyber Essentials Danzell</a> mandates MFA — the control that keeps appearing as the absent defence in every major breach.
$115 Million Settlement
The class action settlement was the largest for a data breach at the time. Under GDPR (not yet in force), the penalty could have been 4% of global turnover. For UK healthcare organisations covered by our <a href="/blog/sector-under-the-microscope-healthcare">sector analysis</a>, the regulatory and litigation exposure from a breach of this scale would be existential.

The sector that holds the most valuable data with the greatest risk.

For UK healthcare organisations, the Anthem breach reinforces the lessons of our healthcare sector analysis: health data is uniquely valuable to attackers, healthcare infrastructure is uniquely vulnerable (legacy systems, flat networks, shared credentials), and the regulatory consequences of a breach are severe. Cyber Essentials certification establishes the baseline. Our penetration testing identifies the vulnerabilities before attackers do. SOC in a Box for Healthcare provides 24/7 monitoring. And UK Cyber Defence provides incident response when a breach occurs.


78.8 million health records. The largest healthcare breach in history. Is your health data protected?

Our <a href="/penetration-testing">penetration testing</a> and <a href="/cyber-essentials">Cyber Essentials certification</a> address the specific controls healthcare organisations need. <a href="https://www.socinabox.co.uk/sectors/gp-surgeries">SOC in a Box for Healthcare</a> monitors 24/7.

Next Step

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Related Articles