Another massive data breach has millions of Americans worried about how to protect themselves from identity fraud and hacking. Recently, the second-largest health insurer in the country, Anthem, disclosed a security breach that may have exposed sensitive information for up to 80 million customers.
According to Anthem, the leaked data included information from current and former customers, "such as their names, birthdays, medical IDs/social security numbers, street addresses, email addresses and employment information, including income data." It also appears that the data was not encrypted. Given the size of the company and the scale of the data breach, tens of millions of Americans are at risk for identity theft and fraud.
Perhaps the most frustrating part of these data breaches is the fact that no amount of password auditing and safe browsing practices on your part could have stopped this. However, there are several things you can do to minimize any damage and remain vigilant going forward.
However, phishing attacks have become more sophisticated over the years, and poorly-constructed emails are being replaced by much more realistic communications.
Anthem indicated they will be mailing (not emailing or calling) customers who were affected and to provide next steps. Many Anthem customers have reported receiving variations on the below phishing email as well as calls from fraudsters:
The above email looks much more convincing. If you suspect you have received or opened a phishing email, here’s what you should do:
Arm Yourself Against Phishing Attacks
The immediate fallout of this incident is that phishing scams are flooding in for Anthem customers. Phishing attacks are generally designed to get more information out of you (like usernames, passwords, and credit card details) or to steal money. Using information the cybercriminals already know, like your name and email address, they might email you, call you, or try to get you to download something by impersonating a company or trustworthy entity. In the past, you could try to spot a phishing email by keeping an eye out for bad spelling and grammar, suspicious-looking attachments, malicious links that are hidden in seemingly-valid links, and messages that try to get you to take action immediately by threatening or intimidating you. The cybercriminals will pretend to be a legitimate service or website but will redirect you to scam sites or to download something to try to get more information out of you. In this example from Microsoft, here’s what phishing emails may have looked like in the past:
However, phishing attacks have become more sophisticated over the years, and poorly-constructed emails are being replaced by much more realistic communications.
Anthem indicated they will be mailing (not emailing or calling) customers who were affected and to provide next steps. Many Anthem customers have reported receiving variations on the below phishing email as well as calls from fraudsters:
The above email looks much more convincing. If you suspect you have received or opened a phishing email, here’s what you should do:
- Don’t click on any links or attachments.
- Report the phishing attempt to the company that is being impersonated.
- File an FTC Complaint (for US residents) or the equivalent for your country.
- When in doubt, go directly to the website of the service, and login to check your account.
- On the company’s website, look for blog posts, alerts, or other information on any security incidents and how they will be responding.
