CareFirst Announces Cybersecurity Breach

A major health insurance provider with a presence in Owings Mills has been the victim of a data breach.

Approximately 1.1 million users who registered online with CareFirst before June 20, 2014, are among those impacted, according to a statement from the company, a division of BlueCross BlueShield.

The attackers may have obtained user names, member names, birthdays, email addresses and subscriber identification numbers, the statement said.

Because passwords are encrypted, users’ accounts (including Social Security numbers, medical claims, employment and credit card/financial information) were not available to the attackers, company officials say.

“Out of an abundance of caution, CareFirst has blocked member access to these accounts and will request that members create new user names and passwords,” the company said in a statement.

CareFirst President and CEO Chet Burrell apologized and offered assistance on behalf of the company.

“We deeply regret the concern this attack may cause,” Burrell said in a statement. “Even though the information in question would be of limited use to an attacker, we want to protect our members from any potential use of their information and will be offering free credit monitoring and identity theft protection for those affected for two years.”

The company set up a website with information about the cyberattack here.