On May 20, CareFirst BlueCross BlueShield announced that they were the victim of a data breach in June 2014 that affects 1.1 million current and former customers.
According to CareFirst, the data breach affects:
|
|
The data breach does not affect:
|
|
This means that the main risks that those affected face are an increased risk of spam/phishing attacks from attackers using the stolen information.
However there is another risk that everyone needs to be aware of: the risk of increased spam and phishing attacks that leverage concern around this situation. And CareFirst’s response has, unfortunately, made the attackers’ jobs easier.
CareFirst has put up a new website to provide information about this attack. Unfortunately, this new website can facilitate spam and phishing attacks for two reasons:
1. It uses a new, custom URL that’s not the main carefirst.com domain.
2. Currently, it does not support SSL by default.
And in fact the current certificate for the site doesn’t actually match the carefirstanswers.com domain.
Taken together, the well-intentioned Carefirst information site makes it easy for attackers to set up competing scam sites using other plausible sounding domains, direct concerned people to the site, instruct them to provide personal information to register for their free credit monitoring and then harvest that information for malicious purposes. In fact, if a scam site were to do this using SSL, it would seem MORE secure and legitimate than the official Carefirst site.
What you can do to protect yourself is if you’re concerned about this situation, don’t go to any website other than the official Carefirst site: www.carefirst.com.
This site does redirect to https://member.carefirst.com but you can verify that you’re on the official site by verifying the SSL certificate.
Once on the official Carefirst site, you can get further information on the situation and what you can do.
This attack continues the trend that we outlined in our Q1 2015 Security Roundup for major healthcare related data breaches in the United States. Based on that, we’re reaching a point where everyone should be extra watchful of activity involving their personal and financial information. This data breach actually occurred 11 months ago, which means that attackers have had this information that long without the victims knowing it. There likely are other data breaches that have happened or are happening that we don’t know about yet.
In addition to increased vigilance, using security products that have robust antispam and antiphishing capabilities like Trend Micro™ Internet Security can also help protect against these sorts of attacks.
Please add your thoughts in the comments below or follow me on Twitter; @ChristopherBudd.
