CareFirst Announces “Phishing” Email Incident; 6,800 Members Offered Protection

Baltimore, Md., March 30, 2018 -- CareFirst BlueCross BlueShield (CareFirst) today announced that the company has been the victim of a “phishing” email attack potentially affecting 6,800 CareFirst members. Phishing attacks use deceptive emails and websites to gather personal information.

On March 12, CareFirst determined that an employee was the victim of a phishing email which compromised the employee’s email account. The compromised email account was used to send spam messages to an email list of individuals not associated with CareFirst. However, because the email account was compromised, the attackers gained access to the employee’s email and could have potentially accessed personal information of 6,800 CareFirst members, including names, member identification numbers, date of birth, and in limited cases (8 individuals) social security numbers. No medical or financial information was compromised.

The original phishing message and the resulting spam messages have been forensically examined by CareFirst’s information security team as well as by a 3rd party information security firm. CareFirst’s systems in general were also forensically analyzed. There was no evidence of malware in the phishing email or spam and no other suspicious activity was detected within CareFirst’s systems. The individual email account was reset.

Though the information accessible in the email account would be of limited use to an attacker and there is no evidence that CareFirst member information has been improperly used, CareFirst will offer free credit monitoring and identity theft protection for those affected for two years. Potentially affected members will be contacted directly by CareFirst with information on enrolling in the protections being offered.

CareFirst has a comprehensive information security program and employees must annually complete mandatory information security training. CareFirst conducts an ongoing security awareness program for employees through which employees are educated about cyberattack tactics about which they must remain vigilant.

About CareFirst BlueCross BlueShield
In its 80th year of service, CareFirst, an independent licensee of the Blue Cross and Blue Shield Association, is a not-for-profit health care company which, through its affiliates and subsidiaries, offers a comprehensive portfolio of health insurance products and administrative services to 3.2 million individuals and groups in Maryland, the District of Columbia and Northern Virginia. In 2017, CareFirst invested more than $33 million to improve overall health, and increase the accessibility, affordability, safety and quality of health care throughout its market areas. To learn more about CareFirst BlueCross BlueShield, visit our website at www.carefirst.com or follow us on Facebook, Twitter, YouTube, LinkedIn, Instagram or Google+.

Attachment:

A photo accompanying this announcement is available at http://www.globenewswire.com/NewsRoom/AttachmentNg/960ec906-4f52-49d3-bcdc-9b1d2f9ccf94

Media Relations
CareFirst BlueCross BlueShield
1-800-914-6397
[email protected]