A Mere 8 Days After Breach, Anthem Healthcare Notifies Customers

In a rare (perhaps unprecedented) move, a large company reported a data breach -- to authorities, the media, and the individuals whose data was stolen -- well before they were legally obligated to do so. Wednesday night, Anthem Healthcare, the nation's second-largest health insurer, began notifying its customers and the media that the personal records of as many as 80 million individuals were compromised -- a mere eight days from when Anthem first detected suspicious activity Jan. 27.

In a statement, Anthem president and CEO Joseph Swedish said, "Once the attack was discovered, Anthem immediately made every effort to close the security vulnerability, contacted the FBI and began fully cooperating with their investigation. Anthem has also retained Mandiant, one of the world’s leading cybersecurity firms, to evaluate our systems and identify solutions based on the evolving landscape."

The initial unauthorized access has been tracked back to Dec. 10. The stolen data includes names, employment data, income data, Social Security numbers, street addresses, email addresses, and medical ID numbers. But investigators say there is no evidence to indicate that medical records (claims, test results, diagnostic codes) or credit card data were compromised.

What is clear is that the attack was extremely targeted: aimed at Anthem specifically, not just any healthcare institution. What is not clear is whether or not the stolen data was encrypted.

According to a security alert issued today by HITRUST:

Anthem has been collaborating with the HITRUST Cyber Threat Intelligence and Incident Coordination Center (C3) since initial discovery of suspicious activity on its network, including sharing of various indicators of compromise (IOCs) consisting of MD5 hashes, IP addresses, and threat actor email addresses.

This crucial observable information was anonymously shared with the HITRUST C3 Community, through the automated threat exchange. It was quickly determined that the IOCs were not found by other organizations across the industry and this attack was targeted at a specific organization.

Upon further investigation and analysis it is believed to be a targeted advanced persistent threat (APT) actor.

Dave Damato, managing director of Mandiant, the organization leading the investigation  into the Anthem breach, confirms "Yes, it was targeted at a specific company." However, the same criminals could carry out similar attacks on other organizations, and just change the indicators of compromise (MD5 hash, IP addresses, domain names, etc.) to make it harder to detect. 

Damato could not share many details about the ongoing investigation, but Adam Meyer, Chief Security Strategist at SurfWatch Labs says, “Anthem discovered the attack when a database administrator noticed unauthorized queries running with admin credentials. Data exfiltration was performed through an external web storage provider 'commonly used by U.S. companies,' which suggests a service such as Google Cloud, Microsoft One Drive, or Dropbox was utilized to reduce chances of detection.”

“Upon discovery," says Meyer, "Anthem reset all passwords with privileged access across their environment and disabled accounts without two-factor authentication. Statements indicating that the company immediately made every effort to close the security vulnerability suggest that a known vulnerability was exploited in the corporate web environment or that a payload was delivered via spear phishing to employees but was easily corrected once identified as the point of entry. Data was exfiltrated to a known cloud storage provider likely utilizing authorized credentials.”   

Damato says that there is no evidence to suggest that an Anthem insider was involved in the breach, so admin credentials were probably stolen by outside attackers.

What remains unclear is whether or not the breached data was encrypted. When asked, Damato's response was itself rather cryptic. What he did say is that the issue with all encryption is that, data has to be decrypted before an authorized user can use the data. So if it could somehow be copied or exfiltrated while it is in use, unencrypted, the fact that it was encrypted while in storage might not matter.

"We are dealing with one of the biggest data breaches in history and probably the biggest data breach in the healthcare industry," says Jaime Blasco, VP and chief scientist of late-stage security startup AlienVault. "If you are wondering what it means for individuals, in a few words: it is a nightmare. If the attackers had access to names, birthdays, addresses and Social Security numbers, it means that information can be easily used to carry out identity theft schemes.

"It is yet unclear who is behind the attack," says Blasco, "but if the group behind that compromised Anthem and plans to sell that information on the black market, it means cybercriminals can buy  access to the stolen data and use that information to drain your bank account, open new credit accounts and telephone accounts or even utility accounts. They can even obtain medical care using your information."

Damato says that his team at Mandiant definitely aims to provide some attribution for the attack, so they can have a better idea of what the attackers will do with the data they've stolen. But, attribution is hard for a variety of reasons. Not only because attackers take pains to obfuscate their identities, but because sometimes an organization has been breached by multiple threat actors, making it "hard to delineate between" them.

"I think the industry as a whole is getting better at attribution," says Damato, "but there's still a lot of noise."

"One thing that's very important and very different," he adds, "is that Anthem reported it before they had to." Damato says it will be very interesting to see what effect that speed has on the investigation and public response.

The responses of customers remains to be seen -- but with the Affordable Care Act's enrollment deadline a mere 10 days away, their opinions may be known quite soon. For their parts, the FBI and the security industry have applauded Anthem for reporting the incident so quickly.

The FBI stated: "Anthem's initial response in promptly notifying the FBI after observing suspicious network activity is a model for other companies and organizations facing similar circumstances."

Damato says that the company reported it so quickly simply because they thought it was the right thing to do.

In his statement, Anthem CEO Swedish said "Anthem’s own associates’ personal information – including my own – was accessed during this security breach. We join you in your concern and frustration, and I assure you that we are working around the clock to do everything we can to further secure your data."