Major Data Breach Exposes Premera Blue Cross Customers

The financial and medical records of more than 11 million Americans have been exposed in a massive cyberattack on health insurer Premera Blue Cross.

“Attackers gained unauthorized access to our IT systems and may have accessed the personal information of our members, employees and other people we do business with,” Premera said.

Premera announced the data breach just one month after Anthem, the second-largest insurer in the United States, disclosed that the personal information of more than 80 million of its customers had been hacked.

Here’s what you should know about the latest health insurer cyberattack:

• Who is affected? The breach affected Premera Blue Cross, Premera Blue Cross Blue Shield of Alaska, and Premera’s affiliate brands, Vivacity and Connexion Insurance Solutions, Inc. “Individuals who do business with us and provided us with their email address, personal bank account number or Social Security number are also affected,” Premera said. In addition, people covered by other Blue Cross Blue Shield plans who sought treatment in Washington or Alaska may also be victims of the attack. Premera is sending letters to those affected.
• What information was accessed? Premera said hackers may have gained access to customers’ personal and medical information including names, date of birth, address, telephone number, Social Security number, email address, member identification number, bank account information, and medical claims information (including clinical information), going as far back as 2002.
• Who is behind the attack? There is no official determination, but there are theories. “Although Premera isn’t saying so just yet, there are indicators that this intrusion is once again the work of state-sponsored espionage groups based in China,” Krebs on Security said. Premera is working with the FBI and security firm Mandian, which specializes in tracking and blocking cyberattacks from state-sponsored hackers, to investigate the attack.

Premera said the breach was discovered Jan. 29, 2015, nearly eight months after the initial attack. As of now, there is no evidence that any of its customers’ information has been used illegally.

Premera’s vice president of corporate communications told King 5 that the company could not go public with the news until now.

“[We had to] make sure the IT systems are secured and protected before an announcement is made,” said Eric Earling. “We were advised that these type of cyberattackers will engage in even more malicious activity if you make an announcement before you secure IT systems.”

Premera is offering two years of free credit monitoring and identity theft protection to people impacted by the cyberattack. Visit premeraupdate.com for more information.

Medical identity theft is on the rise in the United States and it cost Americans $20 billion in 2014.

Has your information been compromised as the result of a cyberattack? Share your comments below or on our Facebook page.