The 2015 Anthem breach exposed the personal information of around 78.8 million people, one of the largest health-sector breaches on record. Attackers gained access, reportedly starting with a phishing attack, and stole names, dates of birth, identity numbers and other personal details. It showed how a health insurer’s vast store of sensitive data makes it a high-value target.

What happened

In 2015, Anthem, one of the largest health insurers in the United States, disclosed a breach that exposed the personal information of around 78.8 million people. The scale placed it among the largest breaches of personal data ever recorded, and its impact on the health sector was profound. For an organisation holding personal details on tens of millions of people, the breach was a stark demonstration of what is at stake when such a data store is compromised.

The Anthem breach became a defining example of the risk facing health-sector organisations, which hold some of the most sensitive personal data of anyone. It is often cited alongside other major breaches as a turning point in awareness of how attractive, and how vulnerable, these large stores of personal information can be.

How the attackers got in

The breach reportedly began with a phishing attack. Attackers are understood to have gained an initial foothold by tricking employees, then used that access to move through Anthem’s systems and reach the database holding personal information. From there, they exfiltrated the data of tens of millions of people over a period before the breach was discovered.

This entry point, phishing leading to a foothold, then movement toward valuable data, is one of the most common patterns in major breaches. It underscores that attackers often do not need a sophisticated technical exploit when they can trick a person into giving them a way in. Defending against phishing, and limiting how far an initial foothold can spread, are therefore central to preventing this kind of breach.

What was exposed

The exposed data was extensive and sensitive. It included names, dates of birth, identity numbers such as social security numbers, addresses, employment information and other personal details. Notably, the exposed data was largely personal and identity information rather than detailed medical records, but that distinction offered little comfort given what was taken.

Identity numbers deserve particular attention. Unlike a password, an identity number tied to a person cannot simply be changed. When such permanent identifiers are exposed, the risk does not fade when the breach is contained. The information remains valid and valuable to criminals for identity theft and fraud long after the incident, which is exactly what makes a breach of this kind so damaging and so lasting.

Why health-sector organisations are targeted

The Anthem breach highlighted why health-sector organisations are such high-value targets. Health insurers and providers hold vast quantities of the most sensitive personal data: identity details, dates of birth, identity numbers, and often health information. That concentration of sensitive data makes them a magnet for attackers, whether criminals seeking to monetise identity theft or others seeking the data for their own purposes.

The sensitivity and permanence of health-sector data compound the risk. Much of what these organisations hold cannot be reset, and it supports fraud and identity theft for years. The combination of enormous scale and deeply sensitive, permanent data is why breaches in this sector are treated so seriously, and why the organisations holding such data carry a heavy responsibility to protect it.

The suspected nation-state dimension

The Anthem breach was widely reported to have been the work of a sophisticated, likely nation-state-linked, actor rather than ordinary criminals. This dimension is significant because it changes the nature of the threat. Where criminals typically seek to monetise stolen data quickly, a nation-state actor may seek personal data on a population for long-term intelligence purposes.

This helps explain the interest in a health insurer’s data. Detailed personal information on tens of millions of people has value beyond immediate fraud, and to a sophisticated actor that value can persist for years. The Anthem breach illustrated that large stores of personal data are targets not only for criminals but for well-resourced actors with different, longer-term motives, which raises the stakes for the organisations holding such data.

The lessons and why monitoring matters

The Anthem breach carries enduring lessons. Phishing remains a leading way attackers gain their initial foothold, so defending against it, and limiting how far a foothold can spread, is essential. The sensitivity and permanence of health-sector and identity data mean it warrants the strongest protection. And the scale of the breach showed how much is at stake when a large store of personal data is compromised.

For organisations holding sensitive personal data, and for individuals affected by breaches like this, monitoring for exposure is part of the response. Because exposed identity details cannot be reset, knowing when they surface allows a faster, protective response. DarkThreatX monitors Tor, Telegram and I2P, along with forums and marketplaces, tracking more than 100 billion records with alerts in under five minutes when exposed data appears. No single source has full coverage of the dark web, and DarkThreatX maintains broad Telegram monitoring across these networks.

To watch for exposure of sensitive data, explore enterprise dark web monitoring or, for individuals, personal dark web monitoring.

For a detailed account, see reputable reporting on the Anthem breach.

Frequently asked questions

How many people were affected by the Anthem breach?

The 2015 Anthem breach exposed the personal information of around 78.8 million people, making it one of the largest breaches of personal data on record and a defining incident for the health sector.

How did the Anthem breach happen?

It reportedly began with a phishing attack that gave attackers an initial foothold. They then moved through Anthem’s systems to reach the database of personal information and exfiltrated the data of tens of millions over a period before discovery.

What was exposed in the Anthem breach?

Names, dates of birth, identity numbers such as social security numbers, addresses, employment information and other personal details. The data was largely personal and identity information, which is especially damaging because identity numbers cannot simply be reset.

Why are health-sector organisations targeted?

They hold vast quantities of sensitive, often permanent personal data, identity details, dates of birth, identity numbers and health information, which makes them high-value targets for both criminals and sophisticated actors. The Anthem breach was widely linked to a nation-state actor.