Morgan Eichensehr reports:
CareFirst BlueCross BlueShield, Maryland’s largest health insurer, has been the victim of a “phishing” email attack that potentially affected 6,800 of its members.
This breach comes about three years after CareFirst weathered another cyberattack that affected more than 1 million of its members. The Baltimore company has 75 percent market share in the state and covers about 3.2 million members in the mid-Atlantic region.
Read more on Baltimore Business Journal.
Update: here’s their press release:
Baltimore, Md., March 30, 2018 (GLOBE NEWSWIRE) — CareFirst BlueCross BlueShield (CareFirst) today announced that the company has been the victim of a “phishing” email attack potentially affecting 6,800 CareFirst members. Phishing attacks use deceptive emails and websites to gather personal information.
On March 12, CareFirst determined that an employee was the victim of a phishing email which compromised the employee’s email account. The compromised email account was used to send spam messages to an email list of individuals not associated with CareFirst. However, because the email account was compromised, the attackers gained access to the employee’s email and could have potentially accessed personal information of 6,800 CareFirst members, including names, member identification numbers, date of birth, and in limited cases (8 individuals) social security numbers. No medical or financial information was compromised.
The original phishing message and the resulting spam messages have been forensically examined by CareFirst’s information security team as well as by a 3rd party information security firm. CareFirst’s systems in general were also forensically analyzed. There was no evidence of malware in the phishing email or spam and no other suspicious activity was detected within CareFirst’s systems. The individual email account was reset.
Though the information accessible in the email account would be of limited use to an attacker and there is no evidence that CareFirst member information has been improperly used, CareFirst will offer free credit monitoring and identity theft protection for those affected for two years. Potentially affected members will be contacted directly by CareFirst with information on enrolling in the protections being offered.
CareFirst has a comprehensive information security program and employees must annually complete mandatory information security training. CareFirst conducts an ongoing security awareness program for employees through which employees are educated about cyberattack tactics about which they must remain vigilant.