Mar 1, 2017

Anthem's historic data breach: What we still don't know 2 years later

Darron Cummings / AP

It's been more than two years since health insurer Anthem publicly announced it was the target of a cyberattack. Hackers stole the birthdays, Social Security numbers and other data for nearly 80 million people — the largest health care data breach ever — yet there are still some unanswered questions.

There's no definitive conclusion of who the hackers were, or whether Anthem faces penalties from the federal government. However, some useful information came from a recent investigation from multiple state departments of insurance.

What we know:

  • Anthem executives have not addressed the cyberattack in any earnings calls since it was announced.
  • Officials say there's no evidence that medical or credit card information was stolen.
  • Anthem has spent at least $260.5 million related to the data breach, most of which went toward improving security and providing credit protection to people who were affected. A spokeswoman said Anthem is still taking "steps to help ensure the security of our systems."
  • The two years of free credit monitoring Anthem provided are up. However, this past December, the National Association of Insurance Commissioners concluded Anthem has to pay more than $15 million for a credit freeze to the roughly 12 million affected Anthem members who were 18 years old or younger at the time of the breach.

What we don't know:

  • Anthem has not disclosed the value of its cyber insurance policy, which defrays some of the costs.
  • The hackers were most likely working on behalf of a foreign government. Many security experts believe it was China, but that has not been proven yet. The FBI would not comment on the pending investigation.
  • It's unclear if Anthem will face a federal penalty. It's by far the largest health care data breach, and the Department of Health and Human Services has imposed fines in the past. The HHS Office for Civil Rights said it "cannot comment on open or potential investigations." Adam Greene, a former HHS official, said it usually takes three to four years before a settlement is reached, and "it's certainly not a given" that HHS will pursue a fine if it believes Anthem had safeguards in place.
  • We don't know for sure that Anthem was fully protected from this type of attack, and a separate federal agency that had a contract with Anthem previously said the insurer did not have controls in place "to prevent rogue devices...from connecting to its networks."
  • Class-action lawsuits are still pending, and fact-finding discovery ended in December. Anthem could escape big damages if people can't show concrete harm.

Go deeper

Al Sharpton says Floyd family will lead march on Washington in August

The family of George Floyd is teaming up with Rev. Al Sharpton to hold a march on Washington on Aug. 28 — the 57th anniversary of the civil rights movement's March on Washington — to call for a federal policing equality act, Sharpton announced during a eulogy at Floyd's memorial service in Minneapolis Thursday.

Why it matters: The news comes amid growing momentum for calls to address systemic racism in policing and other facets of society, after more than a week of protests and social unrest following the killing of Floyd by a Minneapolis police officer.

1 hour ago - Health

Medical journal retracts study that fueled hydroxychloroquine concerns

Photo: George Frey/AFP via Getty Images

The Lancet medical journal retracted a study on Thursday that found that coronavirus patients who took hydroxychloroquine had a higher mortality rate and increased heart problem than those who did nothing, stating that the authors were "unable to complete an independent audit of the data underpinning their analysis."

Why it matters: The results of the study, which claimed to have analyzed data from nearly 96,000 patients on six continents, led several governments to ban the use of the anti-malarial drug for coronavirus patients due to safety concerns.

George Floyd updates

Text reading "Demilitarize the police" is projected on an army vehicle during a protest over the death of George Floyd in Washington, D.C.. early on Thursday. Photo: Yasin Ozturk/Anadolu Agency via Getty Images

All four former Minneapolis police officers have been charged for George Floyd’s death and are in custody, including Thomas Lane, J. Alexander Kueng and Tou Thao, who were charged with aiding and abetting second-degree murder and aiding and abetting second-degree manslaughter.

The latest: A judge Thursday set bail at $750,000 for each of three ex-officers, AP reports.