30,000 Florida Blue Members Impacted by Brute Force Attack on Member Portal
The protected health information of up to 30,063 members of Florida Blue (Blue Cross and Blue Shield of Florida) may have been viewed or obtained by unauthorized individuals in a brute force attack on the Florida Blue online member portal.
Starting on June 8, 2021, unknown individuals conducted a brute force campaign using a large database of user identifiers and corresponding passwords that was available from online sources in an attempt to gain access to the portal. The database appears to have been compiled from data breaches at third party companies where username and password combinations had been compromised.
Florida Blue reports that some of those automated attempts were successful and the attacker gained access to information contained in online member accounts. This information typically included names, contact information, claims information, payment information, health insurance policy information, and other personal information.
While access to accounts was gained, Florida Blue found no evidence to suggest any information in those accounts was removed by the attacker.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Attacks such as this highlight the importance of setting strong, unique passwords for all online platforms. In the event of a breach at one platform, the password cannot then be used to access other accounts.
Florida Blue said when the brute force attack was detected, steps were taken to block the IP addresses used by the attacker. New security measures are being implemented to enhance the security of its web portal to block any further attacks such as this.
Notification letters were sent to affected Florida Blue members starting on June 30, 2021. Affected members have been advised to be vigilant and to review their accounts for any sign of malicious activity, such as unauthorized transactions.
As a precaution against identity theft and fraud, affected members have been offered a complimentary 2-year membership to identity theft protection, detection, and resolution services through Experian.
