CareFirst BlueCross BlueShield has announced that the company has been the target of a sophisticated cyberattack.

According to the company, the attackers gained limited, unauthorized access to a single CareFirst database. The company said that this was discovered as a part of the company's ongoing information technology (“IT”) security efforts in the wake of recent cyberattacks on health insurers. CareFirst said that it had engaged Mandiant to conduct an end-to-end examination of its IT environment, including multiple, comprehensive scans of CareFirst's IT systems for any evidence of a cyberattack.

The review determined that in June 2014 cyberattackers gained access to a single database in which CareFirst stored data that members and other individuals entered to access CareFirst's websites and online services. The company said that Mandiant completed its review and found no indication of any other prior or subsequent attack or evidence that other personal information was accessed.

CareFirst said that evidence suggested that the attackers potentially could have acquired member-created user names created by individuals to access CareFirst's website, as well as members' names, birth dates, email addresses, and subscriber identification number.

The company said, however, that CareFirst user names must be used in conjunction with a member-created password to gain access to underlying member data through CareFirst's Web site. According to CareFirst, the database did not include these passwords because they were fully encrypted and stored in a separate system as a safeguard against such attacks. The database accessed by attackers contained no member Social Security numbers, medical claims, employment, credit card, or financial information, CareFirst said.

Approximately 1.1 million current and former CareFirst members and individuals who did business with CareFirst online who registered to use CareFirst's Web sites prior to June 20, 2014 were affected by this event. All affected members will receive a letter from CareFirst offering two free years of credit monitoring and identity theft protection, the company said.

Chet Burrell, CareFirst president and chief executive officer, stated, “We deeply regret the concern this attack may cause. We are making sure those affected understand the extent of the attack – and what information was and was not affected. Even though the information in question would be of limited use to an attacker, we want to protect our members from any potential use of their information and will be offering free credit monitoring and identity theft protection for those affected for two years.”