In a word, the Anthem Blue Cross data breach is Breach-aggedon.
The names, dates of birth, and Social Security numbers of up to 80 million people were in a database that was hacked by what appears to be a Chinese cyber-espionage ring. Anthem has said no medical information was accessed in the breach, but it remains unclear whether medical codes - which could contain clues to medical information - are involved.
"Of all the data breaches I have seen, this is the one I'm most concerned about because of the scope of the information taken, the amount of data involved and the sophistication of the people that breached Anthem," says Paul Stephens of the Privacy Rights Clearinghouse.
Anthem announced Friday that it is offering two free services to customers for the next two years.
Anthem customers who become ID theft victims -- that means their personal information was used by a thief, not just stolen by one -- will have free access to an ID theft repair program operated by AllClear ID. Anthem customers do not have to enroll to access this service. It's available by default.
Separately, Anthem is offering two years of free credit monitoring to any customers who enroll in AllClear Pro. If you have a credit freeze, credit monitoring may not benefit you.
Parents worried about minor children, however, may want to look over AllClear Pro's ChildScan service. That program, according to Anthem, scans websites to see if a child's Social Security number is being used or sold on scammy websites.
You can find out more about the program details through www.anthemfacts.com or by calling 1-877-263-7995.
It's stressful to be involved in a breach. But you can't weigh your or your child's ID theft risk until you know 1.) if your or your child's data was actually accessed during the breach, and 2.) exactly what data was compromised.
In the meantime, here are answers to some of your questions about identity theft, credit freezes for children, and other breach fallout.
Q. Why is the Anthem breach potentially worse than the Target or Home Depot breaches?
A. Those breaches involved exposure of card information - and you are protected by law from liability from unauthorized use of your credit cards and to a lesser extent, your debit cards.
Stolen social security numbers pose a much greater ID threat because they can be misused in many different ways. For example, a thief could use your SSN to create new credit accounts in your name - wracking up debts that could land on your credit report. (That's called new account fraud and an effective DIY tool for battling that is a credit freeze - it's not a fraud alert-- that you can put on your own reports for a nominal fee.
Scammers also could use stolen SSNs to claim big tax refunds in your name (which could seriously delay your ability to get your refund) or for medical ID theft, which is a kind of insurance billing fraud done in your name. And there also is a booming business in government benefits fraud that ID thieves armed with Social Security information could cash in on.
Q. If I pay $15 to freeze my credit reports at all three credit bureaus, will Anthem reimburse me?
A. No. Anthem's credit monitoring/ID theft protection offer is take it or leave it. According to Anthem spokeswoman Kim Ashley, "Anything that a consumer chooses to do outside of those services is at his/her own expense." Additionally, Anthem told employers that if they independently offer their employees credit monitoring or other services, Anthem will not reimburse them.
That said, the breach has already spawned a number of lawsuits, and it is not yet clear if Anthem will have the final word.
Q. Should I get credit freezes for my minor children?
A. If you get confirmation from Anthem that your child's Social Security number was accessed in the breach, privacy advocates say yes, you should request a credit freeze for your minor child. Financial ID theft involving minors can go undetected for years. "Because it's had longer to perpetuate, it's harder to clean up," says Pam Dixon of the World Privacy Forum.
But, vexingly, it may not be possible to get a freeze for your minor child. People who don't use credit (i.e., kids) don't have credit reports to freeze. Equifax will create a report for a minor and then freeze it if a parent requests it -- but there's a lot of documentation involved and it has to be mailed. Experian, on the other, says if a file doesn't exist, it won't create a security freeze for a minor unless the child lives in a state with a child credit freeze law (Ohio is not one of those).
It may be easier to enroll kids in the AllClear Pro ChildScan program that Anthem is offering -- but wait for confirmation from Anthem that your child's data was hacked before you commit.
If you still want to check to see if your minor child has a credit report, or if your teenager might have a credit report because he or she uses credit cards, you can find out more about checking children's credit report or child security freeze policies at each of the three bureaus:
Equifax - 1-800-525-6285
