Cyberattack on Health Insurer CareFirst Affects 1.1M Members | Healthcare Informatics Magazine | Health IT | Information Technology Skip to content Skip to navigation

Cyberattack on Health Insurer CareFirst Affects 1.1M Members

May 20, 2015
by Rajiv Leventhal
| Reprints

CareFirst BlueCross BlueShield, a Washington, D.C.-based health insurer, has acknowledged a cyberattack on its company where approximately 1.1 million current and former members had their data compromised.

In a company statement, CareFirst said that the attackers gained limited, unauthorized access to a single CareFirst database, which was discovered as part of the company’s IT security efforts in the wake of recent cyberattacks on health insurers. Earlier this year, Anthem, a large Indianapolis-based payer, was attacked, exposing the personal data of approximately 80 million customers.

After review, it was determined that in June 2014 cyberattackers gained access to a single database in which CareFirst stores data that members and other individuals enter to access CareFirst’s websites and online services. Cybersecurity firm Mandiant, hired by CareFirst, completed its review and found no indication of any other prior or subsequent attack or evidence that other personal information was accessed.

Evidence suggests the attackers could have potentially acquired member-created user names created by individuals to access CareFirst’s website, as well as members’ names, birth dates, email addresses and subscriber identification numbers. However, CareFirst user names must be used in conjunction with a member-created password to gain access to underlying member data through CareFirst’s website. The database in question did not include these passwords because they are fully encrypted and stored in a separate system as a safeguard against such attacks. The database accessed by attackers contained no member Social Security numbers, medical claims, employment, credit card, or financial information, the statement said.

 “We deeply regret the concern this attack may cause”, CareFirst President and CEO Chet Burrell, said in the statement. “We are making sure those affected understand the extent of the attack—and what information was and was not affected. Even though the information in question would be of limited use to an attacker, we want to protect our members from any potential use of their information and will be offering free credit monitoring and identity theft protection for those affected for two years.”

Get the latest information on Health IT and attend other valuable sessions at this two-day Summit providing healthcare leaders with educational content, insightful debate and dialogue on the future of healthcare and technology.

Learn More

Topics

News

NCQA Approved by Government as an ONC-Authorized Testing Lab

The National Committee for Quality Assurance (NCQA) has announced that its eMeasure testing laboratory is now approved by the Office of the National Coordinator for Health Information Technology (ONC).

Survey: Infrastructure, Interoperability Key Barriers to Global HIT Development

A new survey report from Black Book Research on global healthcare IT adoption and records systems connectivity finds nations in various phases of regional electronic health record (EHR) adoption. The survey results also reveal rapidly advancing opportunities for U.S.-based and local technology vendors.

Penn Medicine Opens Up Telehealth Hub

Philadelphia-based Penn Medicine has opened its Center for Connected Care to centralize the health system’s telemedicine activities.

Roche to Pay $1.9B for Flatiron Health

Switzerland-based pharmaceutical company Roche has agreed to pay $1.9 billion to buy New York-based Flatiron Health Inc., which has both an oncology EHR and data analytics platform.

Financial Exec Survey: Interoperability Key Obstacle to Value-Based Payment Models

Momentum continues to grow for value-based care as nearly three-quarters of healthcare executives report their organizations have achieved positive financial results from value-based payment programs, to date, according to a new study from the Healthcare Financial Management Association (HFMA).

Cerner, Children's National to Help UAE Pediatric Center with Health IT

Al Jalila Children's Specialty Hospital, the only pediatric hospital in the United Arab Emirates, has entered into an agreement with Washington, D.C.-based Children's National Health System to form a health IT strategic partnership.