The largest data breach settlement officially recorded has been agreed by the health insurer Anthem Inc.
Anthem suffered the largest healthcare data breach ever reported in 2015, with s cyberattack leading to the theft of 78.8 million records of current and former health plan clients. The breach included names, addresses, Social Security numbers, emails, birth dates and employment/income information.
The scale of the data breach resulted in many class-action lawsuits, with in excess of 100 lawsuits consolidated by a Judicial Panel on Multidistrict Litigation. Now, two years later, Anthem has agreed to settle the litigation for $115 million. If this settlement is approved it will be largest single data breach settlement ever
After suffering the data breach, Anthem made an offer of two years complimentary credit monitoring services to all affected plan members. The proposed settlement will, in part, be used to fund a further two years of credit monitoring services.
The alternative options available are:
- People who have already signed up for the credit monitoring services previously offered may be permitted to receive a cash payment of $36 in lieu of the additional two years of cover or
- Up to $50 if funds are still available.
This settlement also includes a sum of $15 million fund to cover out-of-pocket expenses incurred by the plaintiffs, which will be ruled on by a case-by-case basis for as long as there are funds remain available.
In addition to this Anthem has also agreed to put aside ‘a certain level of funding’ to make enhancements to its cyber security defenses and systems, including the use of improved encryption to secure data at rest. Anthem will also be making alterations to how it archives sensitive data and will be putting in place stricter access controls. While the settlement has been agreed, Anthem has not accepted responsibility for any wrongdoing.
Anthem Spokesperson Jill Becher outlined that while data were obtained in the cyber attack, Anthem has not found evidence to suggest any of the information stolen in the cyberattack was used to commit fraud or was sold on for profit. Becher also stated, “We are pleased to be putting this litigation behind us, and to be providing additional substantial benefits to individuals whose data was or may have been involved in the cyberattack and who will now be members of the settlement class.”
While the decision to settle has been agreed upon, the settlement must now be approved by the U.S. District judge in California ruling on the case. District Judge Lucy Koh will hear the case on August 17, 2017.
