Anthem will pay $115 million in largest data breach settlement in history

The 2015 breach saw hackers access records including Social Security numbers, birthdays, addresses, detailed employment information and income data.

Anthem Inc. agreed to pay $115 million in a deal to end a court battle over the 2015 data breach where hackers gained access to sensitive records for nearly 80 million Americans. The funds will go toward credit monitoring and reimbursement for customers, in addition to as much as $38 million in attorneys’ fees.

The 2015 breach saw hackers access records including Social Security numbers, birthdays, addresses, detailed employment information and income data. Chinese state-sponsored attackers were suspected in the attack but there has been no official attribution.

The settlement requires Anthem to guarantee “a certain level of funding for information security and to implement or maintain numerous specific changes to its data security systems, including encryption of certain information and archiving sensitive data with strict access controls,” according to a statement by the plaintiffs’ attorneys. “The settlement is designed to protect class members from future risk, provide compensation, and ensure best cybersecurity practices to deter against future data breaches.”

Anthem faces further court battles. A crucial point in the litigation against Anthem alleges the company willfully neglected cybersecurity, kept the neglect secret and failed to notify customers of the breach in a timely manner.

Earlier this year, it lost a key decision when a federal judge ruled that security audits from before and after the breach will be made public.

In a statement to CyberScoop, Anthem acknowledged the settlement but stressed that it “does not include any finding of wrongdoing, and Anthem is not admitting any wrongdoing or that any individuals were harmed as a result of the cyber attack.”

“As part of the settlement, Anthem has agreed to continue the significant information security practice changes that we undertook in the wake of the cyber attack, and we have agreed to implement additional protections over the next three years,” the company’s statement read.

It’s not clear what those additional protections consist of. We’ve reached out to Anthem seeking clarification.

Additionally, the health insurance titan told CyberScoop it has agreed to “continue the significant information security practice changes that we undertook in the wake of the cyber attack,” including:

• Resetting all passwords for our associates and contractors

• Re-issuing new IDs and passwords for users with elevated access

• Implementing a three-tier authentication model along with one-time, limited-duration passwords for elevated privileged user access; and

• Expanding security logging and monitoring capabilities

Both parties have agreed to the settlement but it still must be approved by the court. A hearing on the matter is scheduled for August 17.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure