Cyber Incident Victim: OneDigital
Date:
Jan 2021
Location:
United States of America
Summary
A cybersecurity incident involving Anthem Inc.'s business associate OneDigital potentially exposed protected health information of 2,003 members after unauthorized network access. While no direct evidence of data misuse was confirmed, compromised information included names, addresses, Social Security numbers, dates of birth, and medical records. The organization notified affected individuals and provided complimentary credit monitoring and identity theft protection services for one year as a precautionary measure. Process improvements were implemented to mitigate future risks following the breach investigation.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On or around January 2021, an unauthorized individual gained access to the network of OneDigital, an insurance broker serving as a business associate to Anthem Inc. This breach potentially exposed protected health information (PHI) belonging to 2,003 Anthem members. While investigators found no direct evidence confirming unauthorized access or data acquisition, Anthem determined the possibility could not be ruled out due to the nature of the network intrusion. The compromised data included names, addresses, dates of birth, Social Security numbers, and medical records. Anthem delayed notification until November 24, 2021, when affected members received breach notices by mail. The organization attributed this delay to the complexity of determining the incident's scope and confirming the involvement of member data.
In response to the OneDigital breach, Anthem offered impacted individuals 12 months of complimentary credit monitoring and identity theft protection services. The company did not disclose technical details about the intrusion vector, containment measures, or specific system vulnerabilities exploited. Separately, Advocate Aurora Health experienced an unrelated incident involving a billing software glitch that mailed statements containing limited PHI—names, service dates, and treatment details—to incorrect addresses for 1,700 patients. Advocate Aurora confirmed no evidence of data misuse but issued precautionary notifications. Both organizations stated commitments to improving internal processes to prevent future occurrences, though neither provided specifics regarding these procedural enhancements.