HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Analysts Suggest Link Between CHS and Anthem HIPAA Breaches

Anthem has started an investigation into the data breach which exposed the personal data of up to 80 million Americans and is attempting to determine how hackers gained access to its systems. The insurer has announced that the first attempt possibly dates back to 10th December, 2014; however some analysts believe the attackers may have first gained hold of the computer systems some nine months previously, with the system potentially having been compromised in April 2014.

The report, published in Forbes, suggests that the “Cybercriminal infrastructure likely used to siphon 80 million Social Security numbers and other sensitive data” bears similarities to the techniques used by a known state-sponsored Chinese hacking group. The group, which operates under names such as Deep Panda, Group 72 and Axiom was responsible for a number of hacks on US companies. The breach has also been linked by some experts to the Heartbleed Bug, which first emerged in 2011.

The fix for the bug was issued in April last year, yet in spite of the danger, many millions of websites have yet to have had the fix installed and could potentially have caused this latest security breach..

While sinister and highly complicated plots are being explored, the answer could be simple and have resulted from a phishing scam or malware infection. The attack was clearly professional, but once a hacker had managed to obtain the login details of one individual with considerable access rights, gaining access to the full system would have been a relatively simple process.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

It is only 6 months since the major breach at Community Health Systems which exposed the data of 4.5 million individuals. That security incident which has been attributed to a group of Chinese hackers, who had used malware to orchestrate the sophisticated attack.

As the investigations proceed further information is expected to emerge, but regardless of who is responsible, the latest breach sends a message to all healthcare organizations that there is a very clear and present danger from hackers and data security must be robust in order to prevent an attack and a breach of confidential data.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.