Please be aware that Anthem, Inc., the parent company of one of our health insurance providers, was recently the victim of a highly sophisticated cyber attack. Anthem has informed us that its member data was accessed, which could include our employees. Please note the attack was not directed at CU's servers, but since a large number of CU employees were affected, we are sharing what we know.
We are working closely with Anthem to better understand the impact on members. Here is what we now know:
- Once Anthem determined it was the victim of a cyber attack, it immediately notified federal law enforcement officials and shared the indicators of compromise with the HITRUST C3 (Cyber Threat Intelligence and Incident Coordination Center).
- The information accessed includes member names, member health ID numbers/Social Security numbers, dates of birth, addresses, telephone numbers, email addresses and employment information. Social Security numbers were only included in a subset of those affected.
- Anthem is still working to determine which members' Social Security numbers were accessed.
- Anthem's investigation to date shows that no credit card or confidential health information was accessed.
- Anthem's Information Security has worked to eliminate further vulnerability and continues to secure its data.
- Anthem immediately began a forensic IT investigation to determine the number of impacted consumers and to identify the type of information accessed. The investigation is ongoing.
- Anthem has advised us there is no immediate indication that any personal information has been misused.
- Anthem has informed us it plans to offer credit monitoring services to affected employees. enrolled in identity repair services. In addition, impacted members will be provided information on how to enroll in free credit monitoring.
While at this time, the cause and impact of the attack is not clearly known, anytime personal information is involved, it is important to guard against phishing attacks.
