> series: anatomy_of_a_breach —— part: 074 —— target: anthem_inc —— records: 78,800,000 —— attacker: deep_panda<span class="cursor-blink">_</span>_
On 4 February 2015, Anthem Inc. disclosed that it had been the victim of a cyberattack that compromised the personal information of approximately 78.8 million current and former members and employees — making it the largest healthcare data breach ever reported. The stolen data included names, dates of birth, Social Security numbers, medical ID numbers, addresses, email addresses, and employment information — everything needed for comprehensive identity theft.
The breach was attributed to a Chinese state-sponsored group known as Deep Panda (APT19), which had gained initial access through spear-phishing emails targeting Anthem employees. The attackers used stolen credentials to access the company's data warehouse and exfiltrated the records over several weeks. Anthem's CEO discovered the breach on 27 January 2015 after noticing a suspicious database query running under his own credentials — credentials that had been compromised without his knowledge. Anthem ultimately paid $115 million in the largest data breach class action settlement at the time.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallHealthcare records are more valuable on the dark web than credit card numbers — a stolen health record can sell for $50-$100 compared to $1-$5 for a credit card. The reason: health records contain the comprehensive personal information needed for long-term identity theft (Social Security numbers, dates of birth, addresses), medical fraud (filing false insurance claims), and cannot be easily changed (unlike a credit card number, you cannot get a new Social Security number or date of birth).
For UK healthcare organisations, the Anthem breach reinforces the lessons of our healthcare sector analysis: health data is uniquely valuable to attackers, healthcare infrastructure is uniquely vulnerable (legacy systems, flat networks, shared credentials), and the regulatory consequences of a breach are severe. Cyber Essentials certification establishes the baseline. Our penetration testing identifies the vulnerabilities before attackers do. SOC in a Box for Healthcare provides 24/7 monitoring. And UK Cyber Defence provides incident response when a breach occurs.
Our <a href="/penetration-testing">penetration testing</a> and <a href="/cyber-essentials">Cyber Essentials certification</a> address the specific controls healthcare organisations need. <a href="https://www.socinabox.co.uk/sectors/gp-surgeries">SOC in a Box for Healthcare</a> monitors 24/7.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call