6,800 CareFirst BCBS Members Impacted by Phishing Attack
A phishing attack on CareFirst Blue Cross Blue Shield has resulted in the exposure of 6,800 plan members’ protected health information.
The attack was detected by CareFirst on March 12, 2018, prompting a thorough investigation, which included a forensic analysis of the email system and CareFirst’s systems in general. In addition to the internal investigation by the CareFirst IT security team, a third-party information security firm also investigated the attack.
The analyses did not uncover any evidence to suggest emails in the compromised account had been opened by the attacker; however, the emails in the account did contain some protected health information and data access could not be ruled out with a high degree of certainty.
Once access to the account was gained, the attacker sent phishing emails to individuals in a contact list. Those individuals were not employed by or affiliated with CareFirst BCBS. The emails were sent with the intention of gaining further login credentials. No malware was involved.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
While 6,800 individuals have potentially been impacted by the incident, only 8 Social Security numbers were exposed. Other types of information that could potentially have been viewed include members’ names, birth dates, and member ID numbers. No financial information was exposed and neither any health information.
The potential for the information in the account to be used for identity theft and fraud is low, but to ensure plan members are protected, all have been offered identity theft protection and credit monitoring services for two years without charge.
CareFirst BCBS explained in its breach notice that it is already mandatory for employees to undergo annual security awareness training. All employees are educated on the risks of cyberattacks, the tactics used to gain access to sensitive data, and told how they must remain vigilant for potential phishing attacks. In addition to the formal training sessions, CareFirst provides ongoing security awareness training throughout the year.
