Anthem
A nation-state attack that started with one phishing email and ended with 78.8 million complete identity profiles.
What happened?
Chinese state-sponsored hackers known as Deep Panda compromised Anthem's enterprise data warehouse starting in early 2014, using a phishing email to gain initial access. By December 2014, they had exfiltrated 78.8 million records. Anthem didn't discover the breach until January 2015.
What data was actually inside?
Names, dates of birth, Social Security numbers, healthcare ID numbers, home addresses, email addresses, phone numbers, employment information, and income data.
Medical history and claims data were not in the compromised warehouse—a rare piece of good news in an otherwise catastrophic breach.
Who gets hurt and how?
78.8 million current and former Anthem members and employees.
Social Security numbers paired with income data and employment history is everything needed for tax fraud, synthetic identity creation, and financial account takeover. Victims are still dealing with the fallout a decade later.
What did they think they were doing right?
Anthem was a Fortune 500 company with enterprise security. They had firewalls, intrusion detection, and compliance certifications. They trusted their employee security awareness training.
What did they not know about their own data?
They didn't know that their enterprise data warehouse—a single system—held 78.8 million complete identity profiles.
They didn't know attackers had compromised 50 accounts and 90 systems. They didn't know someone had been inside their network for nearly a year.
What does attribution look like the morning after?
Anthem faced class-action lawsuits resulting in a $115 million settlement.
HHS levied the largest data breach fine ever at the time: $16 million. Seven state insurance commissioners investigated. Total estimated cost: approximately $260 million.
It took months to notify all 78.8 million victims.
What would have changed the outcome?
Knowing what you have before someone else finds it first.
If Anthem had understood that a single data warehouse contained complete identity profiles for 78.8 million people, they might have protected it differently—or not aggregated that data in the first place.
Don't Learn What You Have From an Attacker
Anthem didn't know their data warehouse held 78.8 million identity profiles until Deep Panda showed them. Risk Finder shows you first.
Start Your Risk Assessment