Anthem Must Face Data Breach Class Action Lawsuit, Judge Rules

A California federal judge will allow unfair competition law claims against Anthem Life Insurance Company to proceed, allowing a class action lawsuit blaming the insurer for a massive data breach to move forward.

Anthem is the second-largest health insurance company in the United States. In February 2015, the health insurance company announced that “cyberattackers had breached the Anthem database,” compromising the personal information of millions of people.

The Anthem data breach reportedly affected about 80 million people, and compromised information including their names, personal health information, birth dates, Social Security numbers, financial information and other personal data.

In the wake of the data breach, consumers across the nation filed class action lawsuits against Anthem and its affiliates. Many affected individuals complained that they were not personally notified about the Anthem data breach until March 2015—and some say they were never personally notified.

More than 100 Anthem data breach class action lawsuits were consolidated and transferred to California federal court in June 2015. They allege Anthem and its affiliates failed to safeguard the personal information of subscribers and failed to adequately notify those who were affected by the data breach.

More than 40 defendants are named in the litigation and the plaintiffs have asserted dozens of claims alleging violations of state and federal claims. Due to the sprawling nature of the multidistrict litigation, U.S. District Judge Lucy Koh required the defendants to only focus on 10 pre-selected claims that were agreed to by all parties.

In her Feb. 14 order, Judge Koh dismissed some state law claims but gave the plaintiffs 30 days to file an amended complaint. She also dismissed the following three Anthem entities from the data breach class action lawsuit: Blue Cross and Blue Shield of Arizona, BlueCross BlueShield of Tennessee and Highmark West Virginia. The judge found that not one of the named plaintiffs alleged any connection with any of these three insurance companies.

Judge Koh recognized that the theft of personal identification information poses harm to consumers, and indicated that this harm is separate from any potential misuse of the information. She also rejected Anthem’s argument that an increase in data breaches would pose a defense against the litigation.

“Under defendants’ theory, a company affected by a data breach could simply contest causation by pointing to the fact that data breaches occur all the time, against various private and public entities,” Judge Koh wrote. “This would, in turn, create a perverse incentive for companies: so long as enough data breaches take place, individual companies will never be found liable. No part of the unfair competition law, the relevant authority addressing causation or the specific facts of this case supports such a legal theory.”

In 2013, the U.S. Department of Health and Human Services fined Anthem $1.7 million for various data security violations. In 2014, the federal government informed health care companies including Anthem about the risk of future cyberattacks, and advised them to implement data encryption and other enhanced security measures to protect their data.

The plaintiffs are represented by Cohen Milstein Sellers & Toll PLLC, Altshuler Berzon LLP, Girard Gibbs LLP and Lieff Cabraser Heimann & Bernstein LLP.

The Anthem Data Breach Class Action Lawsuit is In re: Anthem Inc. Data Breach Litigation, Case No. 5:15-md-02617, in the U.S. District Court for the Northern District of California.

UPDATE: On Feb. 24, 2017, a federal judge in the Anthem Data Breach case has granted a plaintiff request to access government documents.

UPDATE 2: On June 23, 2017, Anthem agreed to pay $115 million to end class action litigation over a 2015 data breach that exposed information of nearly 80 million individuals.

UPDATE 3: October 2017, the Anthem data breach class action settlement is now open. Click here to file a claim.

UPDATE 4: On Nov. 20, 2018, Top Class Actions viewers started receiving checks from the Anthem data breach class action settlement worth as much as $50. Congratulations to everyone who filed a valid claim and got PAID!

UPDATE 5: On Nov. 21, 2019, Top Class Actions viewers started receiving checks from the Anthem data breach class action settlement for out-of-pocket expenses worth as much as $5,000. Congratulations to everyone who filed a valid claim and got PAID!