Anthem health-insurer breach (78.8M records)

What happened

On February 4-5, 2015, Anthem publicly disclosed that a criminal cyberattacker had infiltrated its internally hosted enterprise data warehouse and stolen personal information on approximately 78.8 million current and former members and employees, at the time the largest healthcare-sector data breach in U.S. history. A multi-state insurance-commissioner examination (led by Indiana, with CrowdStrike and Alvarez & Marsal) and Anthem's own investigation by Mandiant traced the intrusion's origin to February 18, 2014, when an employee at an Anthem subsidiary opened a spear-phishing email containing malicious content. Data stolen (in unencrypted form) included names, dates of birth, Social Security numbers, healthcare/member ID numbers, home addresses, email addresses, phone numbers, and employment and income data. Anthem stated no medical claims or payment-card data were taken. The breach is confirmed and heavily documented across regulator settlements, a California DOJ judgment, and a 2019 DOJ indictment.

How it worked

Opening the phishing email launched a download of malicious files to the employee's computer and gave the attackers remote access. From that foothold they moved laterally and escalated privileges, eventually operating with valid administrator-level credentials. The examination report the lead state regulators commissioned from Alvarez & Marsal and CrowdStrike states the attacker used at least 50 accounts and compromised at least 90 systems, ultimately reaching the enterprise data warehouse that consolidated member data across Anthem's regional plans. That report is listed as Exhibit A to the 2016 multistate settlement agreement but is not published inside it; the two figures reach us through GovInfoSecurity's January 2017 account quoting it directly. Bulk queries were then run against the warehouse and archived data was transferred out. The 2019 DOJ indictment separates the phases: reconnaissance on the data warehouse in October and November 2014, then querying it and compressing and encrypting the output in December 2014 and January 2015, then moving the encrypted archives in January 2015 to computers the attackers controlled in the United States and on to China. The 2016 settlement agreement dates exfiltration of the 78.8 million records to beginning in December 2014. The intrusion succeeded and persisted because privileged remote access required only username/password (no two-factor), the network was insufficiently segmented, and security tooling either was not configured to alert on the anomalous activity or alerts (backdoor installs, network scanning, malware, unusual queries) went unactioned. Attribution rested on lookalike domains impersonating Anthem's old "Wellpoint" identity (we11point.com, with subdomains like myhr., hrsolutions., and extcitrix. mirroring real HR and Citrix VPN resources) and Sakula/Derusbi/Mivast malware signed with a DTOPTOOLZ certificate associated with the Deep Panda group.

The lure and the tell

The lure was a spear-phishing email sent to employees of an Anthem subsidiary on February 18, 2014. The indictment records only that the email was transmitted and that malware executed on at least one subsidiary computer; DOJ's announcement adds that the group's emails carried embedded hyperlinks which, when followed, downloaded a file that installed a backdoor. The text of that particular email has never been published, so what made it persuasive is not on the record.

The we11point.com lookalike, with the digits "11" standing in for the letters in "Wellpoint," is the campaign's most-cited deceptive artifact, but it belongs to a later stage. The domain was registered on April 21, 2014 (KrebsOnSecurity, 2015), two months after the intrusion began, and ThreatConnect documented extcitrix.we11point.com and www.we11point.com as command-and-control addresses for Sakula malware, with subdomains such as extcitrix. and hrsolutions. chosen to mirror Anthem's real remote-access and HR resources. So the tell it offers a defender is a monitoring tell rather than a lure tell: a typosquat of the company's own former brand, standing up subdomains that mimicked internal portals. Later, the operational tell that finally surfaced the breach was a database administrator noticing a query running under his own credentials that he had not initiated.

Outcome

The intrusion went undetected for roughly 11 months until an Anthem database administrator noticed a data-warehouse query running under his own credentials on January 27, 2015. An internal Anthem memo to clients, obtained by CSO Online in February 2015, records that he had not initiated the query, stopped it immediately and alerted Anthem's information security department, and that the logon information of additional database administrators was also found compromised. Anthem confirmed unauthorized access on/around January 29, notified the FBI, engaged Mandiant, and cut off the attacker within about three days; the settlement agreement puts the last successful malicious activity on January 30, 2015. It disclosed publicly on Feb 4, 2015, offered credit protection to affected individuals, and made major security investments. Regulators concluded with high confidence they had identified the attacker and with medium confidence it acted on behalf of a foreign government. In May 2019 the DOJ unsealed a four-count indictment charging two PRC nationals over the intrusion, one named and one charged as a John Doe; the named defendant remains at large and wanted by the FBI. Anthem, Inc. renamed itself Elevance Health, Inc. in June 2022.

Why it matters

Anthem is a canonical case showing that one employee's click at a subsidiary can cascade into the theft of tens of millions of records when credentials are reusable across a flat network. It demonstrates the nation-state PII-collection pattern (alongside OPM, Premera, and CareFirst) where medical/financial data is left untouched but durable personal identifiers are harvested for long-term intelligence use rather than immediate fraud. It also underscores that reasonable-sized security budgets don't help if privileged remote access lacks MFA, networks aren't segmented, and alerts aren't monitored: the exact controls Anthem was later ordered to implement.

Defenses

Enforce phishing-resistant multi-factor authentication on all remote and privileged access; segment networks so a single subsidiary foothold cannot reach an enterprise-wide data warehouse; apply least-privilege and privileged-account management so admin credentials aren't broadly reusable; log and actively monitor for anomalous database queries, network scanning, backdoor installs, and access under idle/off-hours credentials; deploy email filtering plus recurring anti-phishing training and mock-phishing exercises; and monitor for lookalike/homoglyph domains impersonating your brand and internal portals (e.g., HR and VPN pages). Treat unexplained queries running under a legitimate user's identity as a high-priority alert.