Anthem, America’s second largest health insurer, has alerted its customers that hackers have stolen the personal information of tens of millions of its customers. Personal information including addresses, birthdays, medical identification numbers, social security numbers and some income data belonging to both current and former customers were swept up in the cyber-attack, according to a statement from Anthem CEO Joseph Swedish.
Free eBook: Modern Retail Security Risk – Get your copy now.
Commenting on this news are three experts in the information security industry: Lior Arbel, CTO at Performanta Ltd.; Dwayne Melancon, CTO of Tripwire; Mark Bower, VP of Product Management for Voltage Security.
Lior Arbel, CTO, Performanta Ltd.:
“Another day, another huge data breach hits the headlines. This hack of tens of millions of Anthem customer information is seeing 2015 carrying on where 2014 left off with high-end data breaches of large enterprises. We have unmistakably now entered a phase in cyber-aggression where hackers have realised that information is power and have begun to up their attacks on corporate targets to steal vital intellectual property or consumer data. Malicious actors are now proving time and again that they have the ability to circumvent traditional security solutions, yet attacks are developing at a rate not matched by the defences.
“Whilst Anthem is to be credited with discovering the breach themselves and notifying the public quickly, this must be seen as another wake-up call for organisations all over the world. Every company must take immediate steps to protect themselves and to detect whether they have already become unknowing victims of the growing tide of cybercrime. This is the time for organisations to take a holistic approach to the security procedures required to combat advanced threats rather than look for a ‘silver bullet’ technology solution. A ‘hands on’ approach by IT departments in conjunction with external data specialists can then help implement, review and enhance security procedures. Do not wait for there to be a successful attack and to suffer the loss of revenue, customer trust, and the potential loss of critical data.”
Dwayne Melancon, CTO, Tripwire:
“Constant vigilance is the watchword for cybersecurity, and this breach demonstrates that any company with information of value can be a target – not just those with credit card numbers. Regardless of the sector, the precautions are consistent – understand what software and systems you have, configure them securely, and understand how they’re vulnerable. And since the threat landscape changes constantly, enterprises must be able to continuously evaluate where the stand and fix security holes as soon as they find them. That can be difficult for any organization, and giving attackers the smallest foothold can result in huge consequences.
“Individuals who are affected, or potentially affected, should freeze their credit reports immediately with the three major credit bureaus – Equifax, Transunion, and Experian – to reduce the risk that anyone can open new lines of credit in their names. This is also a good reminder that you shouldn’t use any of your personally-identifiable information as answers to your ‘secret questions’ to validate your identity online. Make up your own questions and answers, or use answers that are fictitious but memorable to you to prevent criminals from guessing their way into your online accounts.
“Finally, beware of any emails or calls regarding this incident as they are almost certainly fraudulent. Kudos to Anthem for announcing they will notify the affected customers via mail – that is much harder to spoof. Nonetheless, be on the lookout for potentially fraudulent requests for information requested by mail – remember, the criminals have mailing information, as well. Trust, but verify.”
Mark Bower, VP of Product Management, Voltage Security:
“Attackers bypassing traditional perimeter defenses is now routine – and should be expected. The best defense strategy now is to neutralize sensitive data so that a breach yields nothing in the event of compromise. Leading healthcare entities are already embracing data-centric security to prevent this type of breach yielding valuable data when attacked. The reason is simple: healthcare data is lucrative to monetize, and healthcare providers can expect attacks to rise sharply as other industries like retail merchants progressively eliminate exploitable security gaps with data-centric encryption and tokenization. Cybercrime is a business, and attackers swiftly gravitate to the next easy target with advanced malware and exploit tools.”
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.