More than 11 million people may have had
their medical records exposed to hackers who breached Premera Blue
Cross over a recent eight-month period.
The announcement, which Premera made today, comes just two months after a similar breach at health insurer Anthem exposed the personal and financial data of 80 million current and former customers.
The Anthem hack was limited to Social Security numbers, email addresses and other personal data. In the case of Premera, however, the attackers not only had access to birth dates, member ID numbers, bank account info and Social Security numbers, they also may have obtained medical claims records and possibly even sensitive clinical information, the company reported on its web site. Although personal information like Social Security numbers can be used by identity thieves, medical data is potentially more sensitive because it can be used for blackmail or, in the case of celebrities and other public figures, leaked to the media. The UCLA Medical Center, for example, fired 13 employees in 2008 after discovering they had improperly accessed the singer Britney Spears’ medical records while she was being treated at the facility’s psychiatric hospital. The medical records of actress Farrah Fawcett had also been improperly accessed around the same time that news of her cancer fight was leaked to a tabloid.
Premera officials said the investigation into its breach so far has not determined that any data was actually removed from the company’s network and there is no evidence any data has been improperly used.
The attack affected Premera Blue Cross, Premera Blue Cross Blue Shield of Alaska, and affiliate brands Vivacity and Connexion Insurance Solutions. The company said the breach also affected members of other Blue Cross Blue Shield plans who sought treatment in Washington or Alaska.
The company said the breach began May 5, 2014, but wasn’t discovered until January 29—the same day Anthem said it learned of its own breach. Anthem publicly acknowledged on February 13 that it had been breached after media outlets first reported the news. The company indicated the breach had started in early December. It’s not clear why it took Premera Blue Cross longer to disclose its breach after discovering the hack the same day Anthem did.
The two revelations are part of a recent trend of hacks focused on the health care industry and are likely tied to an alert the FBI issued last August to the healthcare industry warning providers that hackers were targeting them after a hospital group called Community Health Systems was hacked, resulting in data on some 4.5 million patients being stolen. The FBI alert has caused companies in the health care industry to take a closer look at their networks for evidence of a breach.
The announcement, which Premera made today, comes just two months after a similar breach at health insurer Anthem exposed the personal and financial data of 80 million current and former customers.
The Anthem hack was limited to Social Security numbers, email addresses and other personal data. In the case of Premera, however, the attackers not only had access to birth dates, member ID numbers, bank account info and Social Security numbers, they also may have obtained medical claims records and possibly even sensitive clinical information, the company reported on its web site. Although personal information like Social Security numbers can be used by identity thieves, medical data is potentially more sensitive because it can be used for blackmail or, in the case of celebrities and other public figures, leaked to the media. The UCLA Medical Center, for example, fired 13 employees in 2008 after discovering they had improperly accessed the singer Britney Spears’ medical records while she was being treated at the facility’s psychiatric hospital. The medical records of actress Farrah Fawcett had also been improperly accessed around the same time that news of her cancer fight was leaked to a tabloid.
Premera officials said the investigation into its breach so far has not determined that any data was actually removed from the company’s network and there is no evidence any data has been improperly used.
The attack affected Premera Blue Cross, Premera Blue Cross Blue Shield of Alaska, and affiliate brands Vivacity and Connexion Insurance Solutions. The company said the breach also affected members of other Blue Cross Blue Shield plans who sought treatment in Washington or Alaska.
The company said the breach began May 5, 2014, but wasn’t discovered until January 29—the same day Anthem said it learned of its own breach. Anthem publicly acknowledged on February 13 that it had been breached after media outlets first reported the news. The company indicated the breach had started in early December. It’s not clear why it took Premera Blue Cross longer to disclose its breach after discovering the hack the same day Anthem did.
The two revelations are part of a recent trend of hacks focused on the health care industry and are likely tied to an alert the FBI issued last August to the healthcare industry warning providers that hackers were targeting them after a hospital group called Community Health Systems was hacked, resulting in data on some 4.5 million patients being stolen. The FBI alert has caused companies in the health care industry to take a closer look at their networks for evidence of a breach.