Anthem anthem.com Anthem data breach (2021): what happened and what to do
A business associate of Anthem suffered a cyber-attack in January 2021 that compromised health information of 6,118 people: names, addresses, dates of birth, email addresses, phone numbers and treatment information.
View all 13,115 breaches- Breach date
- 12 Jan 2021
- Made public
- 15 Oct 2021
- Affected
- 6,118
- Last updated
What happened
This page covers a 2021 incident reported by Anthem, Inc. It's separate from the much larger Anthem breach disclosed in 2015.
Anthem told the U.S. Department of Health and Human Services (HHS) that one of its business associates experienced a cyber-attack. A business associate is an outside company that handles patient information on a health plan's behalf, such as a billing, analytics or mailing vendor. The attack compromised the protected health information (PHI) of 6,118 people. The incident dates to January 2021 and appears on HHS's public breach portal and in California's attorney general breach list.
What was exposed
HHS's description lists names, addresses, dates of birth, email addresses, telephone numbers and treatment information. It does not say Social Security numbers, payment cards or passwords were involved.
Contact details plus a date of birth are what scammers need to impersonate you convincingly. An address, a phone number and an email together let someone call your bank or insurer pretending to be you, or send a message that looks like it came from your health plan. Treatment information adds a layer a fraudster can use to sound legitimate: they can name a procedure or a provider and make a fake bill look real.
Why a vendor breach reaches you
Your health plan shares data with the companies it works with, and you usually never hear their names. When one of them is hacked, the data that leaks is still yours, but the notice comes from the plan. Anthem notified HHS, the affected individuals and the media of the breach.
What Anthem and the vendor did
According to HHS, Anthem and the business associate implemented additional administrative and technical safeguards in response. The description doesn't say how the attackers got in or whether the data was published.
If you received a notice
A letter about this incident means you were one of the 6,118 people. Use the phone number or website in the letter, not links in an email or text, to find out what applies to you. Be wary of any message that mentions the breach and asks you to confirm personal details, because scammers watch the news for incidents like this one.
If you have Anthem coverage but no letter, this particular incident most likely didn't include you. The steps below are still sensible for anyone whose health data has been exposed.
Why health data is different
You can change a password, but not your date of birth or your treatment history. Health information stays useful to a scammer for years, which is why HIPAA requires notification even for a breach of a few thousand people. Scam attempts tied to it can show up long after the incident, so keep the habit of checking any health-related call or message through a number you already trust, such as the one printed on your insurance card.
What to do if you were in it
- 1
Expect phishing that mentions Anthem or the breach
With your phone number, email and treatment details out, calls and texts about claims or billing are the likeliest follow-up. Don't click or call back from the message. Use the number on your insurance card.
- 2
Check your claims
Review each explanation of benefits and call Anthem about any service you didn't receive. False claims are how medical identity theft shows up first.
- 3
Freeze your credit at all three bureaus
A freeze stops anyone from opening new credit in your name. It's free and takes about 10 minutes each at Equifax, Experian and TransUnion. You can lift it temporarily when you apply for credit yourself.
- 4
Be careful with your date of birth
It can't be changed, and it's used to verify you. Don't give it out to anyone who contacts you first, and add a verbal passcode to your insurer and bank accounts if they offer one.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your email address or phone number. Serus monitors breach databases and the dark web and alerts you when your data turns up, but it can't remove data that's already in a breach, so the alerts tell you what to change.
Frequently asked
Was I affected by this Anthem breach?
HHS lists 6,118 people. Anthem notified each person, so a letter about a cyber-attack on a business associate is the sign.
Is this the same as the 2015 Anthem breach?
No. The 2015 breach was a separate and much larger incident. This one is a 2021 cyber-attack on a vendor that handled Anthem member data.
What was exposed?
Names, addresses, dates of birth, email addresses, telephone numbers and treatment information, according to HHS's description.
Should I change my password?
The description doesn't mention passwords. If you reuse your Anthem login elsewhere, change it and turn on two-factor authentication anyway.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
