Hackers gain access to a company database at CareFirst BlueCross BlueShield

 CareFirst BlueCross BlueShield announced yesterday that attackers gained access to a single company database containing the sensitive and personal information of more than a million of its current and former health insurance customers.

BlueCross BlueShield (BCBS) is a federation of health insurance providers serving nearly one-third of the U.S. population. CareFirst is the mid-Atlantic subsidiary of BCBS, delivering health insurance to customers in the District of Columbia, Maryland and Virginia.

In an effort to downplay the attack, CareFirst CEO Chet Burrell and other spokespersons are claiming that Social Security numbers, medical claims, employment, payment card and financial information were not exposed in the breach. However, the database did contain member-created user names, names, birth dates, email addresses and subscriber identification numbers. The breach did not expose passwords, which were both encrypted and stored on a separate server.


Trent Telford, CEO of data security firm Covata, told Threatpost in an email that it’s not always clear why an attacker might want to steal certain information, like names and addresses and usernames, but that doesn’t mean these sorts of data don’t hold value.

“If a company holds personal information on behalf of its customers, partners and employees it is its responsibility to encrypt it and remove the inherent value of this data for thieves and malicious actors,” Telford said. “It is encouraging in the case of CareFirst BlueCross BlueShield that some of its valuable customer data is safe because it is encrypted. The more companies encrypt their customer data, the less they are going to be targets for attacks.”

CareFirst claims it initially detected the attack but incorrectly believed it had contained the attack and prevented the attackers from accessing any information. It only became aware of the full scope of the attack after hiring an incident response firm to perform a network analysis, partly because of a recent spate of cyberattacks targeting similar healthcare companies. The company determined on April 21, 2015, that there was an intrusion of CareFirst’s systems and that it occurred on June 19, 2014. As is the industry standard, CareFirst is offering affected customers two years of free credit monitoring services.

CareFirst is not responding to requests for specific details about the breach, as the incident is part of an ongoing FBI investigation.

CareFirst is in the process of contacting affected customers. Only those customers who registered an online account with CareFirst before June 20, 2014, would have been impacted by the breach. Affected customers will receive an email or an unsolicited phone call with a code redeemable for two years of free credit monitoring. They will also be forced to reset the passwords to their online accounts.

Related Posts:
The CDC’s Affirmative Action Eugenics for the Coronavirus Vaccine
Speaking About News

Daniel Greenfield, When the government decides who gets to live or die based on race. Before the coronavirus pandemic, the Read more

If I Die of Coronavirus, Here’s What I Want You to Remember
Speaking About News

John Hawkins, I know more than a few people that have had corona. My former trainer’s wife. My Muay Thai Read more

Bring Back The Constitution
Speaking About News

Betsy McCaughey, What About The Constitution? Health care workers and first responders are the heroes of the pandemic, but right Read more

What are the treatment options for COVID-19?
Speaking About News

There are several, and which one is best depends on how sick someone is. For example, steroids such as dexamethasone Read more

Send this to a friend