For 343 days, attackers moved through one of the largest health insurers in the country using real credentials and a legitimate file-sharing service, and nothing alerted. The controls that would have caught them had been required by law for over a decade.
On February 4, 2015, Anthem, then the second-largest health insurer in the United States, told the public that attackers had reached records holding the Social Security numbers, dates of birth, home addresses, and income data of 78.8 million people. That was roughly one in four Americans alive at the time. The company had been renamed from WellPoint only weeks earlier, in December 2014, months into an intrusion nobody had yet detected.
Health insurers collect the kind of data people hand over without thinking, because the system depends on it. Verifying eligibility means matching a person to a coverage arrangement. Processing a claim means routing payment through the correct plan. The result is one of the densest stores of permanent personal data anywhere. A credit card is a different kind of loss: the number is cancelled, a new one issued, and the stolen data is worthless within days. A Social Security number cannot be cancelled and a date of birth cannot be reissued, so a name matched with an address, an employer, and an income figure stays usable for years.
The breach did not start inside Anthem’s core systems. On February 18, 2014, almost a year before anyone would notice, an employee at a subsidiary called Amerigroup received a spear-phishing email built to look like something that belonged in that person’s inbox. The employee’s computer was compromised, and what the attackers held at that point was a foothold. It was one workstation, a long way from the data they wanted. From that machine they ran tools to harvest cached credentials, the usernames and passwords a workstation stores so a user does not have to sign in again for every connected service. One compromised machine gave up far more than its owner’s own login.
From there the attackers behaved like a burglar who breaks into a mailroom and finds a ring of keys hanging behind the counter, each one opening a door deeper inside. They used the harvested credentials to move sideways through the network, and each system they entered gave up more credentials and more of the layout. They reached at least 90 systems using at least 50 accounts, and they installed custom backdoors, Derusbi and Sakula, built not for a quick smash-and-grab but for quiet access kept up over months. A typical criminal operation works fast, using tools bought on underground forums until researchers learn their signatures. This one ran the other way, with custom-built malware, a slow pace, and traffic dressed up to look ordinary.
The path led to Anthem’s enterprise data warehouse, the one place that already held copies of records from every subsidiary and business unit, gathered for reporting and analysis. The attackers did not have to break into every office in turn. They had to reach the single room that held a copy of everything. To move the data out, they used Citrix ShareFile, a legitimate cloud service that ordinary invoices and reports and contracts flow through every day. To a monitoring tool, traffic heading for a recognized business service looks nothing like traffic heading for an unfamiliar server in another country.
That is why nothing alerted for 343 days. Automated intrusion detection recognizes patterns: known malware signatures, unusual traffic volumes, connections to flagged addresses, logins from two places at once. This intrusion matched none of them. The credentials were real, harvested from real employees. The logins came from inside the network. The malware had no known signature in any database, and the data left through a service the company might plausibly use. Each individual action was hard to tell apart from an authorized employee doing authorized work.
What broke the pattern was a person. On January 27, 2015, a database administrator running the ordinary review of query performance and system activity saw a query executing under his own credentials, on a system he had not signed into, pulling records he had not asked for. He knew his own baseline well enough to notice that it was wrong. Once the breach was identified, Anthem moved quickly: database access was shut down, the attackers were removed within days, every employee reset their password, and the company engaged Mandiant and notified the FBI. Eight days later it disclosed publicly.
Forensic work pointed to a Chinese state-sponsored group that researchers track as Deep Panda, also known as Shell Crew, Black Vine, and PinkPanther. On May 9, 2019, more than four years after disclosure, the Justice Department announced a four-count indictment, returned by a federal grand jury two days earlier, against Fujie Wang, a 32-year-old Chinese national, and a second person charged only as John Doe. Fujie Wang has not been arrested. An indictment of a foreign national beyond the reach of extradition works, in practice, as a formal act of attribution: a legal record that puts a name and a national affiliation on the public file.
The multi-state insurance examination that followed found a set of controls that had been missing. HIPAA became law in 1996, and its Security Rule set the baseline for how healthcare organizations protect member data: an enterprise-wide risk analysis, access controls that follow least privilege, regular review of system activity, and safeguards on electronic access to systems holding protected health information. One stolen password was enough to open the remote access tools, because multi-factor authentication was not in place there, and each of the 50 accounts the attackers used was guarded by that single factor. Monitoring never rose to the level that might have noticed 50 accounts behaving strangely over a year, and access limits stayed loose enough for a subsidiary workstation to become a route to the warehouse and its 78.8 million records. The risk analysis compounded the rest, because done properly it would have required mapping exactly the path from that subsidiary to the central systems, and examiners found it inadequate.
None of this was new knowledge. HIPAA’s Security Rule had been in force for more than a decade before the breach began, and guidance published in 2013, Tom Walsh’s Security Risk Analysis and Management: An Overview, had laid out exactly the enterprise-wide risk assessment the rule asked for. The controls that would have interrupted this breach at several points were published and required by law before the first phishing email ever reached Amerigroup.
Anthem later put those controls in: multi-factor authentication on all remote access, a privileged-account management system, a security operations center staffed to watch a monitoring platform, and application whitelisting on critical servers. The record documents the cost in unusual detail: $115 million on security improvements, $31 million to notify all 78.8 million affected people, $112 million on credit protection, and $2.5 million on consultants, alongside a $16 million settlement with the Department of Health and Human Services, at the time the largest HIPAA enforcement action on record, and a separate $8.69 million settlement with the California Attorney General that also required an overhaul of the company’s security program.
The gap in this story was not between the threat and the defenses that existed. Every control that would have interrupted the breach was already in the framework the healthcare industry was required to follow. The gap was between what the rules required and what the organization actually ran. Automated defenses can only flag what looks abnormal, and almost nothing about this intrusion did. The defense that finally worked was one person’s familiarity with his own baseline, which is the kind of control a company has to build rather than buy.
