CareFirst BlueCross BlueShield has found that it has been targeted by a spate of cyber attacks lately, the latest discovery of a cyber breach that involves a health insurance provider.
More than one million customers have been affected by the breach, according to CareFirst, but the scope of the attack has somehow been mitigated by the presence of encryption that has been implemented at CareFirst prior to the attack. That means the attackers failed to view the passwords of millions of clients as these were encrypted and stored in a separate server. What they found, instead, were of no value to them whatsoever.
However, the attackers were reportedly able to gain access to a number of sensitive data such as Social Security numbers, employment details, payment card, medical claims and financial data. CareFirst otherwise claimed.
Read also: Why your medical data is most valuable to hackers?
But it was clear that these pieces of information were compromised based on the fact that the database targeted by the attack contained such data as usernames, birth dates, email addresses and other personal identification numbers. These data belonged to former and existing CareFirst BlueCross BlueShield health insurance clients.
The attack is believed to have started in June 2014 and affected customers in the District of Columbia, Maryland and Virginia, where CareFirst delivers health insurance offerings.
Sensitive data like names, addresses and usernames are often the target of attackers, and there’s a growing trend of attacks targeted to the health insurance industry. But why not? Recent studies show that your healthcare data costs more than your credit card information. That is why these kinds of data from health insurance providers become the favorite among attackers because of their large value in the market.
This means that the pressure for health insurance providers to protect their customers’ data is increasing as the threat landscape grows and advanced persistent attacks continue to escalate in sophistication.
The best thing to do, as security experts have always advised, is to encrypt personal information and eliminate probable causes for attackers to launch an attack. In this case, CareFirst succeeded because the passwords of its customers were encrypted before the attack took place.
One thing that would help to reduce the possibility of attacks is increasing the adoption of encryption tools. In this, Anthem failed in a major way, resulting in a major compromise of the data of millions of its clients.
As a remediation process, CareFirst has been contacting affected customers. Specifically, affected customers include those that registered online before June 20 last year.
