Anthem Breach May Have Started in April 2014
Summary: Analysis of open source data on the cybercriminal infrastructure used against Anthem suggests attackers may have gained a foothold in April 2014, nine months before the company says it discovered the intrusion, which siphoned 80 million Social Security numbers and other sensitive data. A domain registered April 21, 2014 as we11point.com - using a numeral one to mimic Wellpoint, Anthem's name before its late-2014 change - was tied to subdomains mimicking Wellpoint's network, and malware signed with a certificate issued to DTOPTOOLZ Co., which CrowdStrike ties to the Deep Panda group.
Key Takeaway: The gap between compromise and discovery ran nine months here, and the article notes Verizon's 2014 report shows that gap widening rather than closing - while HITRUST concluded the indicators were not found at other organizations and declined to issue a broad industry alert.
Read the original at Krebs on Security ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026