(Bloomberg) -- The hackers who infiltrated Anthem Inc. made offwith one of the most prized possessions in computer crime: theSocial Security numbers of as many as 80 million customers of thenation’s second-biggest health insurer.

|

The nine-digit numbers the U.S. government has doled out since1936 typically follow people from birth to death. There are 450million combinations in use, and by learning yours, hackers canobtain credit cards in your name, wire money from your bankaccounts, or learn enough from telephone records or medicalhistories to trick you into divulging more information.

|

“With the data elements compromised in this breach, criminalshave had the keys to the kingdom,” said Paul Stephens, director ofpolicy for Privacy Rights Clearinghouse, a San Diego-based advocacygroup. When companies or agencies use Social Security numbers toboth identify individuals and authenticate they are who they say,it’s “a recipe for disaster.”

|

Unlike payment-card numbers, which are useless once banks findthey’re being used for fraud, your Social Security number isubiquitous and hard to change. They remain the main authenticationmechanism for many essential services, especially ones provided bythe government.

|

It’s rare that one company has so many of them, and that so manyare stolen at one time. For Social Security numbers to be usefulfor criminals, they need to be stolen in conjunction with otherinformation, such as name, address and birth date -- exactly thekind of data that insurers like Anthem collect.

|

Black Market

|

Because criminals need to invest that effort and time to makemoney off of Social Security numbers, other snippets of personaldata that are easier to monetize command a higher price on theblack market. Social Security numbers sell for $3, while mothers’maiden names sell for $6 and the name and password for online bankaccounts sell for $1,000, according to one study from 2011.

|

Many companies decide to store Social Security numbers in acentral location. While that increases their usefulness for dataanalysis, it also raises the risk that hackers could take them allat once, said Orion Hindawi, co-founder and chief technologyofficer for Tanium Inc. The Berkeley, California-based securityfirm works with banks, health-care companies and other largeorganizations.

|

“The most secure way to store something is also the mostexpensive way,” Hindawi said. “If you break up all the data, youcan’t access it to mine it and find patterns. Many companies make achoice about where the line is they’re going to draw, and peopledraw the line in the wrong place.”

|

Copyright 2018 Bloomberg. All rightsreserved. This material may not be published, broadcast, rewritten,or redistributed.

Want to continue reading?
Become a Free PropertyCasualty360 Digital Reader

  • All PropertyCasualty360.com news coverage, best practices, and in-depth analysis.
  • Educational webcasts, resources from industry leaders, and informative newsletters.
  • Other award-winning websites including BenefitsPRO.com and ThinkAdvisor.com.
NOT FOR REPRINT

© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.