How Anthem Shared Key Markers Of Its Cyberattack

Anthem isn't a member of the healthcare industry's information sharing and analysis center, the NH-ISAC, so the NH-ISAC got word of the attack via other members of the threat information-sharing community the morning after Anthem reported its massive data breach.

The NH-ISAC then confirmed and validate with Anthem the indicators of compromise that it had received that morning via its members. "We got the information from participating members. Once we received it, we did confirm with Anthem," says Josh Singletary, NH-ISAC CIO, who heads up intelligence operations. That information then was pushed out to other ISACs as well, he says. The ISAC pushed the indicators of compromise via email to its members as well as via its secure portal, which some members use to incorporate them into their IDS/IPSes, firewalls, and other systems.

The process of how Anthem's attack markers were shared among the healthcare industry and other relevant groups and organizations provides a rare peek at how potential victims are notified about the latest threat emerging from a major breach. As attacks and attack campaigns intensify and multiply, intelligence-sharing groups like ISACs and others are crunched to get usable information and intelligence to their members quickly so they can shore up their defenses and prevent becoming the next victims.