DES MOINES, IOWA (September 30, 2020) — Attorney General Tom Miller has joined 43 other AGs in a $39.5 million settlement with Anthem stemming from the massive 2014 data-breach that involved the personal information of 78.8 million Americans.
Iowa will receive $199,694 from the settlement. In addition to the payment, Anthem has also agreed to a series of data-security and good-governance provisions designed to strengthen its practices going forward.
In February 2015, Anthem disclosed that cyber attackers had infiltrated its systems beginning in February 2014, using malware installed through a phishing e-mail. The attackers were ultimately able to gain access to Anthem’s data warehouse, where they harvested names, dates of birth, Social Security numbers, health-care identification numbers, home addresses, e-mail addresses, phone numbers, and employment information for 78.8 million Americans. In Iowa, 172,727 residents were affected by the breach.
“Anthem has agreed to several provisions to strengthen its security practices, and I’m hopeful that these would prevent future breaches and protect consumers,” AG Miller said.
The security practices include:
- A prohibition against misrepresentations regarding the extent to which Anthem protects the privacy and security of personal information;
- Implementation of a comprehensive information security program, incorporating principles of zero trust architecture, and including regular security reporting to the Board of Directors and prompt notice of significant security events to the CEO;
- Specific security requirements with respect to segmentation, logging and monitoring, anti-virus maintenance, access controls, and two-factor authentication, encryption, risk assessments, penetration testing, and employee training, among other requirements; and
- Third-party security assessments and audits for three years, as well as a requirement that Anthem make its risk assessments available to a third-party assessor during that term.
In the immediate wake of the breach, at the request of the Connecticut Office of the Attorney General, Anthem offered an initial two years of credit monitoring to all affected US individuals.
In addition to this settlement, Anthem previously entered into a class action settlement that established a $115 million settlement fund to pay for additional credit monitoring, cash payments of up to $50, and reimbursement for out-of-pocket losses for affected consumers. The deadlines for consumers to submit claims under that settlement have since passed.
In the settlement, AG Miller is joined by the attorneys general of Alaska, Arizona, Arkansas, Colorado, Connecticut, the District of Columbia, Delaware, Florida, Georgia, Hawaii, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Nebraska, New Hampshire, New Jersey, Nevada, New York, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, Tennessee, Texas, Virginia, Washington, West Virginia, and Wisconsin.
