Attached. Please let me know if you have any questions or need revisions.

Running head: CAREFIRST DATA BREACH

CareFirst Data Breach

Institutional Affiliation
Student Name
Instructor
Course
Date

1

CAREFIRST DATA BREACH

2

CareFirst DATA BREACH
CareFirst BlueCross is a health insurance company established in the United States that
offers several coverage. It is an expansive network in the health insurance industry that provides
coverage to members moving to other areas in the United States or outside. It provides coverage
to you adults under the age of 30. Its main product includes dental insurance, health insurance,
Medicare plans, and vision insurance. Most of its products are considered data-driven, for instance,
it clinical trials data are stored digitally and shared by scientist and other authorized personnel.
They share data among doctors anywhere in the United States to hospitals supported by them.
Coordination among doctors and patients is easy since data sharing is made easy over the network
(Moffit & Steffen, 2017).
BlueCross Blue Shield stores various kinds of data related to patients and their health
insurance cove plans with such services. It services more than 62 million people in the United
States. In 2015, the company announced one of the greatest data breaches in its history. The cyber
attacker accessed a single database which paves the way to information that individuals use to
access the website and other online services. CareFirst BlueCross Blue Shield reported no prior
attacks on the website; the attacker had access only to a single database involving data about their
members. The members use this data to access the CareFirst website (CareFirst, 2015).
The CareFirst Cyber-attack report indicated no personal data related to their users was
accessed. The company reported that the single databases could have been used to access personal
information such as names, birth dates, subscribers identification numbers, and email addresses.
For security reasons, CareFirst uses names and member-created passwords to access the website;
there, therefore, the affected several users, but the majority of them their information was secure.
The accessed database did not contain data on members related to financial information, social

CAREFIRST DATA BREACH

3

security numbers, credit card, medical claims, or their employment history (Goldstein & Abelson,
2015).
The passwords were fully encrypted by the CareFirst Security Network and stored on
separate databases. Such security measures are essentials for cases like this, as attackers will need
access to both databases before they penetrate further. This would have been the case if the
databases were not separate and more members could have been affected. The incident occurred
in 2015, but more recently in 2018, as reported by Healthcare IT News, another potential breach
in which the patient personal data of about 6 800 members was compromised through phishing.
This incident occurred due to phishing emails received by an employee.
The data breach in 2015 resulted in tight security by CareFirst BlueCross BlueShield
insurance company. But this did not stop the cyber attackers. The use of separate databases was
one of the major security measures that were put in place. Thus, attackers targeting CareFirst are
still hunting the organization to gain patient data sold in black markets or commit financial fraud.
The phishing incident contained information regarding dates of births, member identification
numbers, and their names. CareFirst's CEO reported that the information would not of much use
to attackers, but security was important for the organization and its members.
In its investigation to determine the breach ...