Anthem data breach could cost company billions

Enlarge Photo

Andrew Harrer | Bloomberg

The Anthem Inc. website is displayed on a laptop computer for a photograph in Washington, D.C., U.S., on Thursday, Feb. 5, 2015. Anthem Inc., the second biggest U.S. health insurer by market value, said hackers obtained data on tens of millions of current and former customers and employees in a sophisticated attack that has led to a Federal Bureau of Investigation probe. Photographer: Andrew Harrer/Bloomberg

Corey Noles

Reporter- St. Louis Business Journal

Email

The cost of the recent breach of Anthem's client databases could reach billions of dollars, according to a local attorney with experience in data security.

Dan Nelson, an Armstrong Teasdale attorney who deals with trade secrets, contracts and securities, said Anthem should expect to pay between $100 to $200 per breached record. With as many as 80 million people affected, that comes out to $8 billion to $16 billion.

"That's a very serious amount of money for any company, regardless of how big it is," Nelson said, noting that the a minimum could be $50 per record — still a lofty $4 billion price tag.

Anthem denied that the attack will have a substantial financial effect, in a Feb. 4 article in The Wall Street Journal.

"Anthem said it doesn't expect the incident to affect its 2015 financial outlook, "primarily as a result of normal contingency planning and preparation,"' according to the article.

Another issue for Anthem is that, according to CNET, the company has only $100 million in cyber security insurance.

Anthem also denied that CNet would have any knowledge of their policy in an email late Friday afternoon.

"No one at Anthem has discussed our cyber insurance coverage and do not believe that CNET would know what it is," spokeswoman Deb Wiethop said in the email.

The information reported in the CNet story is actually tied to an unidentified source in an article from The Insurance Insider, which notes that AIG holds the policy.

Nelson said cyber security insurance for large companies has been a problem for some time.

"Often, insurance companies don't want to write policies large enough to actually protect a company of that size," he said, noting that there are now approximately 30 companies who write such policies.

Anthem confirmed last week that the compromised data could include client names, dates of birth, social security numbers, physical and email addresses, and medical IDs.

Anthem announced Wednesday that it would provide identity theft services to all individuals affected. Anthem announced Friday afternoon that customers dating back to 2004 are eligible for free identity repair assistance and credit monitoring services.

Customers can now sign up for those services by visiting anthemfacts.com. Customers who have yet to receive a mailed notification are still eligible to sign up now.

Anthem has warned since the data breach that criminals are attempting to gather personal information from the company's customers through phone calls and emails. The company said it will notify customers by mail within the coming weeks if their specific information was accessed.

Health Care, Education