Anthem Hacked: 80 million customers

[sheehs1]

Edit: I signed up at AnthemFacts, and received the email a few minutes later. The redemption code doesn't work on the normal signup page of AllClearPro, a separate link for Anthem customers is needed. If it exists I can't find it.

The address I used was in the email . It took me several tries and I was just getting ready to call them to tell them their link didn't work….when it then worked. I was able to sign up for the PRO and received the confirmation.

Edit: That was a fast response for you. I think you were right for all that respond they probably are generating redemption codes.

Edit: I took the link out for the PRO site as it didn't appear to work right when I keyed it in here. It will be in the email confirmation for those that register.

 

[MichaelB]

The address I used that was in the email is www.anthem.allclearid.com/PRO. It took me several tries and I was just getting ready to call them to tell them their link didn't work….when it then worked. I was able to sign up for the PRO and received the confirmation.

Is this the address you were using?

Edit: That was a fast response for you. I think you were right for all that respond they probably are generating redemption codes.

I was looking for that link on the web page, not the email. Thanks. After multiple tries it came up. I'll enroll DW and see how it works.

Edit - it's the same login I used for the Home Depot authorized account. I went ahead and enrolled DW.

 

[ulrichw]

Former and current Anthem subscriber, so I've been through the process...

[...]AllClearIDSecure AND it told me "affected individuals" can enroll in the AllClearIDPRO.[...]

The one thing worth noting here is that the AllClearIDSecure is a "credit repair" service. i.e. I read this as meaning that it does nothing proactive.

If at some point in the next 24 months you discover that somebody fraudently used your information, they will assist in fixing any issues. (But I believe they will not reach out to you - you will have to call them to take advantage of this service - quote from their letter: "If a problem arises, simply call 1-877-263-7995 and a dedicated investigator will do the work to recover financial losses, restore your credit, and make sure your identity is returned to its proper condition.")

I think it's important to note that they probably can't do anything that you couldn't do yourself - the law is on your side here. The FTC (Federal Trade Commission - Federal Trade Commission | Protecting America's Consumers) has many resources available to you to understand what you can do... For example, see:
Disputing Errors with Credit Reporting Companies | Consumer Information

Without coming out saying I was affected it gave me a redemption code to sign up of the Pro piece indicating ...yep….the hackers got my record as only those affected can sign up

I think you're reading too much into this. The only information one has to enter to get this letter is a first and last name. Chances are they're not even verifying these, but even if they are, there will be many duplicates and triplicates.

As previous posters have mentioned, Anthem is doing the "right thing" here by not being very restrictive on who gets this letter. This doesn't mean that your information was NOT leaked, but you shouldn't take it as verification that your information is out there, either. I expect more announcements about the scope of the breach when Anthem finds out more.

I believe that the text you received is what everybody received who filled in the form on allclearid's site (it certainly is the same as I and my wife received).

 

[FIREd]

We have been trying to sign up for AllClearID for the past hour and we cannot get our accounts activated. Their systems seem to be overloaded at the moment.

 

[sheehs1]

We have been trying to sign up for AllClearID for the past hour and we cannot get our accounts activated. Their systems seem to be overloaded at the moment.

Hope you get thru soon! Have you tried the phone number too?

 

[LoneAspen]

For those of you who did a freeze with Equifax, have you gotten your PIN in the mail yet?

I initiated the freeze via their web site, but had problems, so I called their number and the lady told me the freeze took effect and to expect the PIN in the mail in a few days. I also confirmed the $10 fee showed up on my credit card.

The other day, I got something from Equifax but it was some one-page letter offering to remove my name from some marketing mailing list, or something like that. Had nothing to do with a freeze PIN.

Has anybody gotten their PIN from Equifax? How long did you have to wait for it to show up in the mail?

 

[FIREd]

Hope you get thru soon! Have you tried the phone number too?

It took a few hours to get the phone call needed to activate our accounts. And it didn't work right away. But it's finally all done.

For those of you who did a freeze with Equifax, have you gotten your PIN in the mail yet?

I initiated the freeze via their web site, but had problems, so I called their number and the lady told me the freeze took effect and to expect the PIN in the mail in a few days. I also confirmed the $10 fee showed up on my credit card.

The other day, I got something from Equifax but it was some one-page letter offering to remove my name from some marketing mailing list, or something like that. Had nothing to do with a freeze PIN.

Has anybody gotten their PIN from Equifax? How long did you have to wait for it to show up in the mail?

We have not received our PIN from Equifax by mail yet. Like other posters reported, we received an error message when we tried to freeze my wife's credit through Equifax online. We did not get a PIN even though the freeze succeeded. She called Equifax (1-888-298-0045) the next day and was able to retrieve the PIN that way.

 

[scrabbler1]

For those of you who did a freeze with Equifax, have you gotten your PIN in the mail yet?

I initiated the freeze via their web site, but had problems, so I called their number and the lady told me the freeze took effect and to expect the PIN in the mail in a few days. I also confirmed the $10 fee showed up on my credit card.

The other day, I got something from Equifax but it was some one-page letter offering to remove my name from some marketing mailing list, or something like that. Had nothing to do with a freeze PIN.

Has anybody gotten their PIN from Equifax? How long did you have to wait for it to show up in the mail?

I never got my PIN from Equifax, either. But a few minutes ago, I called them at the # FIREd posted just above (thank you) and after a short but somewhat clumsy phone chat, I got a confirmation # for the call and the agent initiated the PIN getting mailed to me.

I said clumsy because we had some trouble with the security questions. He asked me some questions about recent CC balances and Credit limits (on cards and credit lines). I knew what my last payment amount was but didn't know off the top of my head what my other Credit limits were. I know I have the CC limit on my main card but unluckily for me I had just done one of my paper sort-&-shred-&-file things so my recent statement was put away and not within arm's reach. I asked him if he had any questions about recent cars I had owned because they are often used as security questions.

He was a little skittish about having enough proof about my identity but felt sure enough that I was "me" so he moved forward with the PIN release.

 

[sheehs1]

The only one I have received via mail has been TransUnion. I received the same letter from Equifax regarding taking my name of some marketing list that LoneAspen received.

That said, the day I did my freezes I DID get PIN Numbers from all three and with Equifax I also got a confirmation number along with the PIN (via internet or phone).

I thought I'd wait a bit longer for the mail confirmations and call the other two…just because it makes me more comfortable to get the confirmation of the above PINs via mail.

p.s. Since all of this, the Anthem hack and the credit freezes, I have been getting some threatening phishing phone calls. By threatening I mean, calling me by my first name, giving me their name and "threats to have me arrested by a magistrate or Federal prosecutor asking me to help them help me (Ha!) and phone calls from the IRS asking me to call them back. The phone numbers have been from CA, New York, FLorida, etc. I don't even answer them. They leave voice mail messages! The timing may be coincidental but I certainly feel more comfortable with the freezes on my credit now.

 

[fidler4]

Any idea how to deal with our kids that are part of Anthem? Since their names,DOB's and SS#'s were compromised does it make sense to register each of them for the credit watch service?


Sent from my iPad using Early Retirement Forum

 

[Gumby]

I got my Equifax PIN online when I initiated the security freeze.

 

[grasshopper]

I will do the Alfred E Newman thing, since I found my 2006 BCBS application from AZ and I didn't give them my SS#. What me Worry.

 

[explanade]

I got my Equifax PIN online when I initiated the security freeze.

Ditto, for all 3.

 

[Corporate ORphan]

Anyone hear of Chex Services? I got the following from a message board of my former mega-corp's former employees. (We were taken over by another big company in 2008). ANy ideas how to check if this is legit and another thing we should do to protect ourselves? I thought the credit bureaus are what the financial institutions use.


Since we are talking about scams/fraud/identity theft. As most people know, if you are a victim of identity theft, you should put a fraud alert on your credit with Transunion, Equifax, etc. credit bureaus. But a lot of people do not know you should also put a security alert to keep the scammers from opening checking/savings accounts using your name and social security number. The banks/saving and loans/brokerage firms, etc. use something called "ChexSystems" to check to see if a new customer has any issues (bounced checks, over drawn, etc.) with previous accounts at other institutions, or if there has been fraud. So, you should put a security alert on "ChexSystems" also. https://www.consumerdebit.com/consumerinfo/us/en/index.htm


ChexSystems Consumer Assistance
The Chex Systems, Inc. network is comprised of member financial institutions that regularly contribute information on closed checking and savings accounts. ChexSystems shares this information among its member institutions to help them assess the risk of opening new accounts. ChexSystems does not make account opening decisions for its members. Account opening decisions are made by the member institutions based on their internal policies.

 

[Chuckanut]

Apparently, the personal customer information that they held was not encrypted, thus making it very easy for the criminals to make use of the information.

It seems to me that organizations are going to have to start encrypting information they hold on other people. If an organization does not care if its e-mails, business plans, etc. get stolen and made public, that is their business. But, when the hold information on customers, employees, contractors, etc., they need to encrypt it.

And they need to beef up access protection to that encrypted information. Employees who have legitimate access to to private information need more than password protected accounts to un-encrypt the information. (My understanding is that the Anthem break-in started with getting an employee's password.)

Perhaps, every such employee should have a dongle that gives a unique authorization code every time they longon to use an encrypted database.

At some point these corporations and government organizations have to start taking our privacy much more seriously.

 

[Major Tom]

At some point these corporations and government organizations have to start taking our privacy much more seriously.

A big +1 to that. There needs to be serious legal repercussions for organizations not meeting certain minimum security standards when dealing with the private data of customers.

If we aren't already at the tipping point for legislation to be drafted, what else will it take?

 

[eytonxav]

If we aren't already at the tipping point for legislation to be drafted, what else will it take?

Maybe a big class action lawsuit

 

[Bikerdude]

Just curious if anyone has received a letter from Anthem?

 

[MichaelB]

Just curious if anyone has received a letter from Anthem?

No, and I know we're in the group with compromised data.

 

[sheehs1]

No ..not yet. And based on the response from AutoID I'm fairly confidant my data was compromised. I have no reason to think it was not.

 

[MissMolly]

Just curious if anyone has received a letter from Anthem?

I did in a round-about way from the state retirement system:


Due to the recent Anthem cyberattack, current and former Anthem members (dating back to 2004) are being offered identity repair assistance and credit monitoring services, at no cost, via AnthemFacts.com starting today, Friday, Feb. 13, 2015.

What is Anthem providing?
Anthem has arranged to have AllClear ID protect your identity for two years at no cost to you. The following identity protection can be used at any time during the next two (2) years:

Credit monitoring: Members may enroll in credit monitoring, which alerts consumers when banks and creditors use their identity to open new credit accounts.
Identity theft repair assistance: Should a member experience fraud, an investigator will do the work to recover financial losses, restore the member’s credit, and ensure the member’s identity is returned to its proper condition. This assistance will cover any fraud that has occurred since the incident first began.
Child identity protection: Child-specific identity protection services will also be offered to any members with children insured through their Anthem plan.
What do I need to do?

Credit monitoring is provided at no cost, but requires enrollment. Learn how to sign up at AnthemFacts.com or call 877-263-7995.
Identity Theft Repair assistance (AllClear SECURE), can be activated with a phone call. If a problem arises, simply call 877-263-7995 and a dedicated investigator will do the work to recover financial losses, restore your credit and make sure your identity is returned to its proper condition.
Child identity protection and other additional layers of protection (AllClear PRO), including credit monitoring and a $1 million identity theft insurance policy require enrollment through AnthemFacts.com. For a child under 18 years old, AllClear ID ChildScan identifies acts of fraud against children by searching thousands of databases for use of your child’s information. To use the PRO service, you will need to provide your personal information to AllClear ID. Learn how to sign up at AnthemFacts.com.
When is it available?

Now, as of 2 p.m. ET on Friday, Feb. 13, 2015, visit AnthemFacts.com or call 877-263-7995. AllClear ID is ready and standing by to assist you. You may access these services at any time during the 24 month coverage period. Anthem will also notify potentially impacted current and former members by U.S. Postal mail with this same information on credit monitoring and identity protection services.

What else can I do?

Report incidents
Anthem recommends that potentially impacted members remain vigilant for incidents of fraud and identity theft, including reviewing account statements and monitoring free credit reports. In addition, you can report suspected incidents of identity theft to local law enforcement, Federal Trade Commission, or your state attorney general. To learn more, you can contact the FTC:

Federal Trade Commission
Consumer Response Center
600 Pennsylvania Avenue, NW
Washington, DC 20580
(877) 438-4338
Identity Theft | Consumer Information

Contact the credit bureaus
You can obtain additional information from the FTC and the nationwide credit bureaus about fraud alerts and security freezes. You can add a fraud alert to your credit report file to help protect your credit information. A fraud alert can make it more difficult for someone to get credit in your name because it tells creditors to follow certain procedures to protect you, but it also may delay your ability to obtain credit. You may place a fraud alert in your file by calling just one of the three nationwide credit bureaus listed above. As soon as that bureau processes your fraud alert, it will notify the other two bureaus, which then must also place fraud alerts in your file. In addition, you can visit the credit bureau links below to determine if and how you may place a security freeze on your credit report to prohibit a credit bureau from releasing information from your credit report without your prior written authorization.

Equifax
PO BOX 740241
ATLANTA GA 30374-0241
800-685-1111
equifax.com
https://www.freeze.equifax.com/Freeze/jsp/SFF_PersonalIDInfo.jsp

Experian
PO BOX 9532
ALLEN TX 75013
888-397-3742
experian.com
Security Freeze

TransUnion
PO BOX 6790
FULLERTON CA 92834-6790
800-916-8800
transunion.com
Credit Freeze | Place a Security Freeze on Your Credit | TransUnion

What if I have other questions?
Please visit AnthemFacts.com to learn how to access these services. Anthem has also established a dedicated toll-free number for questions related to this incident. That number is 877-263-7995.

 

[ERhoosier]

Seems this hack was sophisticated and originated overseas.

China suspected in major hacking of health insurer - The Washington Post

Security firm finds link between China and Anthem hack - The Washington Post

Personally, I plan to keep my credit freezes on indefinitely. I find this cybersecurity expert's quote from the Post rather disturbing----
“China sucks up as much information as possible on a variety of people that could come in handy later”

 

[sheehs1]

Personally, I plan to keep my credit freezes on indefinitely.

Me too. I have every reason to believe with the stealing of SSN numbers it will remain a threat.

p.s. Thanks for the Washington Post links!

 

[timo2]

"A federal watchdog agency says Anthem Inc. has refused to allow it to conduct vulnerability scans of the health insurer's systems in the wake of its recent massive data breach affecting 78.8 million individuals. Anthem also refused to allow scans by the same agency in 2013" This agency would be involved because Anthem does business with the Federal Government.
Anthem Refuses Full IT Security Audit - GovInfoSecurity

 

[Live Free]

This week the Washington Post had an article that I think gets to the issue of how neither the government or private businesses are working together to help the little guy. This article basically describes the pointing fingers at each other that Turbo Tax and the IRS and state governments are doing. No one is taking charge and the number of identity thefts for filing of false federal refunds is in the millions per year now.


Who’s to blame when fraudsters use TurboTax to steal refunds? - The Washington Post