Health Care Service Data Breach

While driving to work this morning I heard in FM radio about yet another data breach, this time the victims were the customers of Premera Blue Cross, which is a major health care service. As I used to have health insurance service via Blue Cross Blue Shield until last year, the news made me quite curious and little worried, so I surfed online to find more on what really happened.

An intrusion into the Premera Blue Cross’s network may have resulted in the breach of financial and medical records of 11 million customers. The company said its investigation revealed that the initial attack occurred on May 5, 2014 and they found out about this attack only on January 29, 2015. In their statement the company said that the incident affected Premera Blue Cross, Premera Blue Cross Blue Shield of Alaska, and our affiliate brands Vivacity and Connexion Insurance Solution.

“Our investigation determined that the attackers may have gained unauthorized access to applicants and members’ information, which could include member name, date of birth, email address, address, telephone number, Social Security number, member identification numbers, bank account information, and claims information, including clinical information. This incident also affected members of other Blue Cross Blue Shield plans who sought treatment in Washington or Alaska.

“Individualswho do business with us and provided us with their email address, personal bankaccount number or social security number are also affected. The investigationhas not determined that any such data was removed from our systems.  Wealso have no evidence to date that such data has been used inappropriately.”

The company will be notifying the affected customers via letters and it has announced to offer two years of free credit monitoring services through big-three credit bureau Experian. The company further mentioned that it is working with security firm Mandiant and the FBI in the investigation.

The days of massive data breaches in major retailers and health care services are far from over. In my opinion they are targeted because their system holds the millions of users records and information. If I was one of those 11 million customers who get letter indicating my information has been hacked and I have been offered two years of free credit monitoring, I do not think I will feel better about getting free credit monitoring offer for two years. When the customers provide their information to the health care provider, trust was the main factor and the company has lost that now. I think it was their responsibility to ensure the information is not exposed to the intruders and I still do not understand how something big like this was identified after more than 8 months.  The company mentioned in its website that “The security of our members’ personal information is a top priority”, but at this time they seemed to have lost their members’ trust already.

Reference:

Krebs on Security (2015). Premera Blue Cross Breach Exposes Financial, Medical Records.  Retrieved from https://krebsonsecurity.com/2015/03/premera-blue-cross-breach-exposes-financial-medical-records/