Identity-theft expert Robert Siciliano discusses the Anthem data breach that exposed 80 million Social Security numbers and birth dates. He explains how breaches typically happen through phishing and hacked employees, and what people should do: freeze their credit, use identity-theft protection, and run antivirus software.
Chapters
One of the nation's biggest health insurers is the latest to be hit by hackers. Anthem says the personal information of 80 million people may have been compromised. That includes the birth dates and Social Security numbers of customers and employees. Now, the insurer says credit card and health information was not taken. Robert Siciliano is an identity theft expert with the firm Hotspot Shield. He is in Boston for us tonight. Robert, good to see you. So So the fact that another company was hacked is certainly not a surprise to you and the work that you do, but you do tell us that, you know, America, you need to understand this. This is a fact of life and you may not like it, but you need to accept it, correct?
Yeah, you know, homes are broken into every day, banks are robbed, businesses are hacked. That's just the way of the world today. And so as long as consumers recognize that and they take the necessary proactive steps to protect information that's in their own control, then they reduce their chances of being victims of identity theft.
So, eh, the Washington Post is reporting that investigators suspect that, uh, Chinese hackers may be responsible for the Anthem breach. Um, I don't know if you can confirm that or what your work tells you about that, but share your thoughts that the Chinese may be involved in this.
You know, these hacks occur, uh, all day every day to corporations, government agencies, and private citizens, and they are perpetrated by criminals from all over the world, and they utilize, uh, inter— Internet Protocol addresses that can easily be masked, and they can be shown to show up from Russia or China or Brazil or the US or Canada or anywhere. So it's very difficult to pinpoint the exact whereabouts of criminal hackers due to the fact that the anonymity of the web— of the web— makes it so much easier for them to do so.
And these could be individuals in China and not necessarily linked to the government of China. Probably important to say that. So Anthem, uh, we're talking about here, was fined $1.7 million back in 2010 for a breach disclosing the data of what, more than 600,000 people? Shouldn't it have known better and protected its data better?
You know, you also have to keep in mind that they also are a victim of a crime here, uh, and that Generally, these companies have everything to lose and nothing to gain in the event that a breach like this occurs.
Right.
So while they spend millions potentially on fines, they're spending at least that on information security, the hardware and the software to make sure that this doesn't happen. So when a vulnerability is discovered by the company itself, they do everything possible to patch it and they bring in what's called penetration testers to look for those vulnerabilities. But every so often something happens, usually a human on the inside is hacked, and when that human is hacked, generally they're getting an email, and that email usually has some type of an infected link that ultimately the employee clicks on and it can infect the network.
Okay, a couple of things here before I lose you here. The big issue with the Anthem breach is that Social Security numbers apparently were compromised here. Remind us of what you get, because this gets scary when you can access someone's Social Security number.
Yes, the Social Security number here in the US is the key to the kingdom.
Yeah.
And once a criminal has it in their possession, they can simply pose as you. They can open up new lines of credit just like you can. They can buy cars and homes. They can get credit cards and loans. And so when that happens, obviously it damages the credit of the actual victim. So it's important that consumers be proactive about this. Regardless of if your social's involved in this particular breach, you should enlist in things like identity theft protection, which ultimately works towards protecting your identity, and also get what's called a credit freeze. A credit freeze is something you get through the credit bureaus, and it helps to lock down your social on your credit report, preventing criminals from opening up new lines of credit under your name. It's a simple process. Everybody should have a credit freeze, and you should also consider identity theft protection.
I got one more quick one for you. Remind us again that personal information doesn't mean private information. Make the distinction for us.
That's a good one. So personal identifying information, PII, is your name, your address, your phone number. It's also your email address, right? And it's also your credit card number and bank account number and your Social Security number. This is personal identifying information, not necessarily private information.
Right.
That being said, while this data is considered by people to be private, you give it out to store clerks, you give it out to people at the airport. Right. And government agencies and doctors' offices and insurance companies. So while it's personal, it's not necessarily private. So your job is essentially to make that data useless to a thief, a bad guy, because you're going to give it out. And the way to do that, like I said, is a credit freeze, identity theft protection, get antivirus, anti-spyware, anti-phishing, and a firewall. Lock down your operating system and consider a virtual private network. My client's Hotspot Shield, they protect your wireless connection to the internet.
Well done, well done, Robert. Robert Siciliano is an identity theft expert with the firm Hotspot Shield, joining us from Boston tonight. Robert, thank you.
