Delaware News

Attorney General Jennings Announces Multistate Settlement Over 2014 Anthem Data Breach

Department of Justice | Department of Justice Press Releases | News | Date Posted: Wednesday, September 30, 2020



Attorney General Kathy Jennings announced Wednesday that Delaware has joined a total $39.5 million settlement with Anthem stemming from the massive 2014 data breach that involved the personal information of 78.8 million Americans. Through the settlement, Anthem has reached a resolution with the 43-state multistate coalition and California. The DOJ’s Consumer Protection Unit helped secure the settlement.

In February 2015, Anthem disclosed that cyber attackers had infiltrated its systems beginning in February 2014, using malware installed through a phishing email. The attackers were ultimately able to gain access to Anthem’s data warehouse, where they harvested names, dates of birth, Social Security numbers, healthcare identification numbers, home addresses, email addresses, phone numbers, and employment information for 78.8 million Americans. In Delaware, approximately 62,000 residents were affected by the breach.

“Companies, like Anthem, that collect and maintain personal information have a duty to maintain its security and privacy,” said Attorney General Jennings. “Anthem breached that trust and today my office, together with other attorneys general, is holding it accountable.”

Under the settlement, Anthem has agreed to a series of provisions designed to strengthen its security practices going forward. Those include:

  • A prohibition against misrepresentations regarding the extent to which Anthem protects the privacy and security of personal information;
  • Implementation of a comprehensive information security program, incorporating principles of zero trust architecture, and including regular security reporting to the Board of Directors and prompt notice of significant security events to the CEO;
  • Specific security requirements with respect to segmentation, logging and monitoring, anti-virus maintenance, access controls and two factor authentication, encryption, risk assessments, penetration testing, and employee training, among other requirements; and
  • Third-party security assessments and audits for three (3) years, as well as a requirement that Anthem make its risk assessments available to a third-party assessor during that term.

In the immediate wake of the breach, at the request of the Connecticut Office of the Attorney General, Anthem offered an initial two years of credit monitoring to all affected U.S. individuals.

Delaware will receive $162,707.05 from the settlement which will go to the state’s Consumer Protection Fund. In addition to the payment, Anthem has also agreed to a series of data security and good governance provisions designed to strengthen its practices going forward.

In addition to this settlement, Anthem previously entered into a class action settlement that established a $115 million settlement fund to pay for additional credit monitoring, cash payments of up to $50, and reimbursement for out-of-pocket losses for affected consumers. The deadlines for consumers to submit claims under that settlement have since passed.

image_printPrint


Graphic that represents delaware news on a mobile phone

Keep up to date by receiving a daily digest email, around noon, of current news release posts from state agencies on news.delaware.gov.

Here you can subscribe to future news updates.

Attorney General Jennings Announces Multistate Settlement Over 2014 Anthem Data Breach

Department of Justice | Department of Justice Press Releases | News | Date Posted: Wednesday, September 30, 2020



Attorney General Kathy Jennings announced Wednesday that Delaware has joined a total $39.5 million settlement with Anthem stemming from the massive 2014 data breach that involved the personal information of 78.8 million Americans. Through the settlement, Anthem has reached a resolution with the 43-state multistate coalition and California. The DOJ’s Consumer Protection Unit helped secure the settlement.

In February 2015, Anthem disclosed that cyber attackers had infiltrated its systems beginning in February 2014, using malware installed through a phishing email. The attackers were ultimately able to gain access to Anthem’s data warehouse, where they harvested names, dates of birth, Social Security numbers, healthcare identification numbers, home addresses, email addresses, phone numbers, and employment information for 78.8 million Americans. In Delaware, approximately 62,000 residents were affected by the breach.

“Companies, like Anthem, that collect and maintain personal information have a duty to maintain its security and privacy,” said Attorney General Jennings. “Anthem breached that trust and today my office, together with other attorneys general, is holding it accountable.”

Under the settlement, Anthem has agreed to a series of provisions designed to strengthen its security practices going forward. Those include:

  • A prohibition against misrepresentations regarding the extent to which Anthem protects the privacy and security of personal information;
  • Implementation of a comprehensive information security program, incorporating principles of zero trust architecture, and including regular security reporting to the Board of Directors and prompt notice of significant security events to the CEO;
  • Specific security requirements with respect to segmentation, logging and monitoring, anti-virus maintenance, access controls and two factor authentication, encryption, risk assessments, penetration testing, and employee training, among other requirements; and
  • Third-party security assessments and audits for three (3) years, as well as a requirement that Anthem make its risk assessments available to a third-party assessor during that term.

In the immediate wake of the breach, at the request of the Connecticut Office of the Attorney General, Anthem offered an initial two years of credit monitoring to all affected U.S. individuals.

Delaware will receive $162,707.05 from the settlement which will go to the state’s Consumer Protection Fund. In addition to the payment, Anthem has also agreed to a series of data security and good governance provisions designed to strengthen its practices going forward.

In addition to this settlement, Anthem previously entered into a class action settlement that established a $115 million settlement fund to pay for additional credit monitoring, cash payments of up to $50, and reimbursement for out-of-pocket losses for affected consumers. The deadlines for consumers to submit claims under that settlement have since passed.

image_printPrint


Graphic that represents delaware news on a mobile phone

Keep up to date by receiving a daily digest email, around noon, of current news release posts from state agencies on news.delaware.gov.

Here you can subscribe to future news updates.