Anthem Hacked: 80 million customers

[Chuckanut]

What bothers me is that much of this confidential information about employees and customers is not even encrypted. Encrypting important data is Secruity 101. There is nothing exotic about it.

 

[LoneAspen]

Here's an update for those about to start this process...

Equifax - Used their online web page, and everything went smooth until after I put in credit card info and got an error something like "we couldn't process your request". Called them, and the lady verified my identity, and confirmed the freeze took effect and I'd be receiving the PIN by US mail in a few days. Took less than 5 minutes online, and probably another 20 or so on the phone (mostly on hold).

Experian - Used their online web page. It asked a few questions to verify my identity, and provided me with the freeze PIN at the end. Took less than 5 minutes.

TransUnion - Used their automated phone system at 1-888-909-8872. Was very simple. Had to give a six-digit security code of my own choosing for any future requests, but that's different than the PIN they assign for freeze purposes. It said to expect a packet by US mail containing that PIN in a few days. Took less than 5 minutes.

All in all, a very simple process, and $30 spent. Well worth it to protect against the incompetence of these companies who seem to be incapable of protecting our information.

 

[Major Tom]

Scrabbler:
The phone numbers I got off their websites...if it helps anyone are:

Equifax: 1-800-685-5000 (automate attendant and went smoothly)
Experian: 1-888-397-3742 ( I did this one online and it worked perfectly)
Transunion: 1-888-909-8872 (live person)

FYI - the phone number you quoted above for Experian is incorrect. The correct number is 1-888-397-3742. I called the number you quoted, and ended up with a very annoying automated telephone questionnaire that told me I qualified for a free Caribbean cruise and some free system that alerts somebody if I fall and can't get up.

I am not an Anthem customer, but seeing that I very rarely apply for anything that would require a credit check, have decided to place a credit freeze on all 3 of my accounts. This morning, I accessed my free credit report from Experian, ensured that there was nothing untoward on it, and froze it. For some reason, they were unable to do the credit freeze online, so I did it over the phone.

I'll check and freeze my accounts with the other 2 bureaus in good course.

Thank you sheehs1 for starting this thread.

 

[sheehs1]

FYI - the phone number you quoted above for Experian is incorrect. The correct number is 1-888-397-3742. I called the number you quoted, and ended up with a very annoying automated telephone questionnaire that told me I qualified for a free Caribbean cruise and some free system that alerts somebody if I fall and can't get up.

I am not an Anthem customer, but seeing that I very rarely apply for anything that would require a credit check, have decided to place a credit freeze on all 3 of my accounts. This morning, I accessed my free credit report from Experian, ensured that there was nothing untoward on it, and froze it. For some reason, they were unable to do the credit freeze online, so I did it over the phone.

I'll check and freeze my accounts with the other 2 bureaus in good course.

Thank you sheehs1 for starting this thread.

Major Tom, My apologies. You are correct and if I could change the original phone number listing I would. I remember I initially typed it as "392"…checked my piece of paper…did a double take…and thought I had changed it to the "397' but alas…obviously did not. I have got to get better glasses!!

Wonder if a moderator would be so kind as to change it? Can you moderators do that?

 

[Major Tom]

Major Tom, My apologies. You are correct and if I could change the original phone number listing I would. I remember I initially typed it as "392"…checked my piece of paper…did a double take…and thought I had changed it to the "397' but alas…obviously did not. I have got to get better glasses!!

Wonder if a moderator would be so kind as to change it? Can you moderators do that?

The funny thing is that I actually participated in the first automated telephone survey, thinking to myself that it was rather an unprofessional and odd thing for Experian to do while their customers were holding. By the time I had been told by the robo-voice that I was eligible for a "free" Caribbean cruise and was also eligible for some kind of "Senior Lifeline" thing, I got really suspicious. Then, after declining both offers, when the phone system hung up on me instead of connecting me to Experian, I realized I had been "had"!

It's OK. At worst, all they have is my phone number, and their automated system knows that I am over 50, yet under 65. I don't think they can do much with that

 

[Gumby]

Wonder if a moderator would be so kind as to change it? Can you moderators do that?

Done

 

[Bikerdude]

What bothers me is that much of this confidential information about employees and customers is not even encrypted. Encrypting important data is Secruity 101. There is nothing exotic about it.

+1. They might as well have put up a sign that said "Hack us first".

 

[sheehs1]

Done

Thanks Gumby! Much appreciated!!

 

[Sunset]

I tried the freeze once, after a hack, problem was it caused me to miss out on a good CC offer.
Companies should encrypt all this data, its really easy.
As for a punishment, don't fine a company, just jail the CEO and CFO and board of directors for endangering peoples financial lives.
A penalty like that would make secure encryption job #1 at every big company.

 

[eytonxav]

This is one of the more comprehensive articles I have seen on what to do:
Anthem hack: Seven ways to protect yourself right now | ZDNet

 

[foxfirev5]

Just froze all three for DW and I. It only took 35 minutes online. However I'm not really pleased about the $60 I just spent. Also, I don't anticipate any future accounts I'll be opening, so hopefully this will be the end of it for awhile

 

[Goonie]

I froze all three last Thursday evening online, and all went with Experian and Transunion. However, like several others have stated, Equifax went smoothly until it came time for it to spit out a PIN. Then got the "Sorry..." message.....and no PIN. Checked my CC account and it was charged the $10 fee. Checked back on Equifax, and the Freeze was activated.

I finally got through to a human this afternoon, and got things all squared away! The PIN is being mailed.

 

[Major Tom]

I also froze all 3 last night and this morning. Forget the exact details, but one of the bureaus wouldn't do it online, so I did with an automated system over the phone. One of them didn't give me a PIN online, but said they were mailing it.

Either way, it's all taken care of. I'm not even an Anthem customer, but I apply for new credit so very rarely that I figured freezing it with all 3 bureaus is a great way to give me peace of mind.

Now I just need to ask Vanguard to implement 2-factor authentication via a voice message instead of text (as I don't have a cellphone) and I'll be feeling quite secure

 

[Bikerdude]

My free credit monitoring service from the Target hack expires at the end of the month so I signed up for the free Home depot identity protection. I guess I'll have to wait to see if I'm affected by the Anthem hack.

 

[MichaelB]

My free credit monitoring service from the Target hack expires at the end of the month so I signed up for the free Home depot identity protection. I guess I'll have to wait to see if I'm affected by the Anthem hack.

Just did that. The Target service - ProtectMyID - let me look into the credit file. This new service from HomeDepot doesn't, or at least I haven't found a way. I think all it's going to do is notify if there's a credit transaction. I like the Target one better.

 

[Bikerdude]

I think all it's going to do is notify if there's a credit transaction. I like the Target one better.

That's also the impression I get. I agree Target was better.

 

[explanade]

Now I just need to ask Vanguard to implement 2-factor authentication via a voice message instead of text (as I don't have a cellphone) and I'll be feeling quite secure

I just enrolled on the 2-factor online.

Initially I set it up for my iPhone. But what if I lose the iPhone and lose the ability to log on?

So I used my Google Voice number and the GV app on my iPhone and iPad can both get SMS. In addition, you can set up GV to forward emails to you when you get texts and calls. The latter will be transcribed (speech recognition is so-so along with a link to hear the actual call).

So you can do it with a GV number, which doesn't require any cell plan.

 

[audreyh1]

80 million customers is 25% of the US population!

 

[Major Tom]

I just enrolled on the 2-factor online.

Initially I set it up for my iPhone. But what if I lose the iPhone and lose the ability to log on?

So I used my Google Voice number and the GV app on my iPhone and iPad can both get SMS. In addition, you can set up GV to forward emails to you when you get texts and calls. The latter will be transcribed (speech recognition is so-so along with a link to hear the actual call).

So you can do it with a GV number, which doesn't require any cell plan.

I just set it up, and verified that I can indeed receive texts on my GV number.

Thank you. This means that maybe I'll be able to go for a few more years before I have no choice but to get a cellphone!

 

[Major Tom]

80 million customers is 25% of the US population!

It is indeed a mind-bogglingly large number.

 

[audreyh1]

It is a bit confusing.

80 million company records were hacked - so we don't know it this is a 1:1 on customers.

They currently cover 37 million people, or 1 in 9 Americans. But previous customers records might have been hacked.

 

[misanman]

They also have affiliates (like the BCBS in our state). The local news advised that affiliate customer data may be included in the breach because the client data is shared to allow possibility of service across the affiliated companies. Stay tuned, but that might help explain the higher numbers.

Sent from my HTC6500LVW using Early Retirement Forum mobile app

 

[audreyh1]

They also have affiliates (like the BCBS in our state). The local news advised that affiliate customer data may be included in the breach because the client data is shared to allow possibility of service across the affiliated companies. Stay tuned, but that might help explain the higher numbers.

Sent from my HTC6500LVW using Early Retirement Forum mobile app

Yeah, that's what we're afraid of.

 

[sheehs1]

It is a bit confusing.

80 million company records were hacked - so we don't know it this is a 1:1 on customers.

They currently cover 37 million people, or 1 in 9 Americans. But previous customers records might have been hacked.

It is a huge number (prior and current customers and employees). As you said, 25% of the population.

Wonder how long that query took? Anybody wager a guess? Just wonder how long it may have run to grab 80 million records and store if offsite before the system administrator noticed. Gives me an idea of their vigilance on security.

 

[MRG]

It is a huge number (prior and current customers and employees). As you said, 25% of the population.

Wonder how long that query took? Anybody wager a guess? Just wonder how long it may have run to grab 80 million records and store if offsite before the system administrator noticed. Gives me an idea of their vigilance on security.

I've seen run away queries that run for days unnoticed, ones that would never come back. Sitting there eating an entire cpu(s), nobody noticed. If they just built a simple result set maybe a few hours; subject to system queueing, network, disk, and cpu.. Of course they could have chunked the data up and had multiple result sets to be aggregated together later.

I've not seen anything specifically saying how the data were accessed. Maby they hooked a backup, san checkpoint, or a simple ftp.

Edit to add: 80 million rows sounds like a lot of data. When you get into high volume transactional DBs or warehousing that is a very small number. Your talking maybe billions of rows in a single table that may relate to many other tables some of similar sizes.