HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

6,800 CareFirst BCBS Members Impacted by Phishing Attack

A phishing attack on CareFirst Blue Cross Blue Shield has resulted in the exposure of 6,800 plan members’ protected health information.

The attack was detected by CareFirst on March 12, 2018, prompting a thorough investigation, which included a forensic analysis of the email system and CareFirst’s systems in general. In addition to the internal investigation by the CareFirst IT security team, a third-party information security firm also investigated the attack.

The analyses did not uncover any evidence to suggest emails in the compromised account had been opened by the attacker; however, the emails in the account did contain some protected health information and data access could not be ruled out with a high degree of certainty.

Once access to the account was gained, the attacker sent phishing emails to individuals in a contact list. Those individuals were not employed by or affiliated with CareFirst BCBS. The emails were sent with the intention of gaining further login credentials. No malware was involved.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

While 6,800 individuals have potentially been impacted by the incident, only 8 Social Security numbers were exposed. Other types of information that could potentially have been viewed include members’ names, birth dates, and member ID numbers. No financial information was exposed and neither any health information.

The potential for the information in the account to be used for identity theft and fraud is low, but to ensure plan members are protected, all have been offered identity theft protection and credit monitoring services for two years without charge.

CareFirst BCBS explained in its breach notice that it is already mandatory for employees to undergo annual security awareness training. All employees are educated on the risks of cyberattacks, the tactics used to gain access to sensitive data, and told how they must remain vigilant for potential phishing attacks. In addition to the formal training sessions, CareFirst provides ongoing security awareness training throughout the year.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.