Anthem Hit With Data Breach Class Action Lawsuit

Late last week, a class action lawsuit was filed against Anthem Inc., the country’s second largest health insurer, over a massive data breach alleging that the company failed to properly encrypt its data.

Lead plaintiff Kathryn Leniski filed her Anthem class action lawsuit in California federal court on Friday. In it, she claims that Anthem was warned by federal agencies to protect high value data provided by its customers. However, Leniski claims that Anthem still failed to adequately encrypt its customers’ data despite this warning.

Leniski alleges that her data was stolen from Anthem in the data breach and used to file a 2014 tax return on her behalf and collect a refund check. She further alleges that Anthem took almost a month to notify her of the data breach. She also claims that the breach came after data was stolen from another health care company, Wellpoint, who had to pay the Department of Health and Human Services $1.7 million in penalties for failure to protect the data.

According to the Anthem data breach class action lawsuit, “Ms. Leniski must now incur additional costs to protect her identity and to guard against cybertheft going forward, all the while mindful that her highly personal Social Security number is in adverse hands, along with other confidential personal information, creating a significant risk of her being further victimized by cyberfraud and theft throughout the balance of her life.”

Anthem “stores highly sensitive and highly confidential information about current and former customers and employees, including social security numbers (‘SSNs’), names, addresses, dates of birth, medical records and financial information,” the class action lawsuit alleges, and “they are required and duty bound to safeguard from unauthorized disclosure and theft.”

The class action plaintiff alleges in her class action lawsuit, “Because the data breach includes Social Security numbers and dates of birth, criminals can easily open credit in their names. If they had simply stolen a credit or debit card number, a consumer could just get a new card. But in this instance, they stole the skeleton key to someone’s credit.” The class action lawsuit also alleges that Anthem admitted that the data had not been encrypted while it was stored after the data breach occurred.

The class action lawsuit accuses Anthem of negligence, unjust enrichment and breach of contract and fiduciary duty, and seeks unspecified damages. Leniski also seeks to represent all consumers whose health and personal information was exposed in the breach.

A single medical record can garner as much as $250 in a black market auction compared to cents on the dollar for credit card information because it includes Social Security information, according to experts consulted by the plaintiff in her class action lawsuit. Additionally, more than 29 million people have been affected by 740 major health care breaches over the past five years, according to statistics from the U.S. Department of Health and Human Services.

Leniski is represented by Eve H. Cervantez and Jonathan Weissglass of Altshuler Berzon LLP.

The Anthem Data Breach Class Action Lawsuit is Leniski v. Anthem Inc., et al., Case No. 5:15-cv-02992, in the U.S. District Court for the Northern District of California.

UPDATE: On Feb. 14, 2016, a California federal judge allowed unfair competition law claims against Anthem Life Insurance Company to proceed, allowing a class action lawsuit blaming the insurer for a massive data breach to move forward.

UPDATE 2 February 24, 2017: A federal judge in the Anthem Data Breach multidistrict case has granted a plaintiff request to access government documents.