Elevance Health (Anthem)

Anthem's 2015 breach set records that stood for nearly a decade: 78.8 million people, and a resulting $16 million HIPAA settlement with HHS that was nearly triple the previous largest ever ($5.55 million, Advocate Health Care, 2016), plus a $115 million class settlement that was at the time the biggest consumer data breach settlement in US history - roughly $179 million in total penalties and settlements. But the enforcement findings are the part that should sting. Federal investigators concluded Anthem had never conducted an enterprise-wide risk analysis, lacked adequate procedures to review its own system activity, failed to identify and respond to known security incidents, and had insufficient access controls to stop attackers from moving laterally once inside. The attackers got in through a phishing email answered by one employee at a subsidiary and roamed the network for eight weeks. Class members who already had credit monitoring could claim an alternative cash payment of up to $50, and documented out-of-pocket losses were reimbursable up to $10,000 per person.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-08-04

Primary source. www.hipaajournal.com/16-million-anthem-hipaa-breach-settlement-takes-ocr-hipaa-penalties-past-100-million-mark/ — Verified - primary source confirmed.

Arbitration

MAJOR DOJ FALSE CLAIMS ACT LAWSUIT (filed May 1, 2025, District of Massachusetts): the DOJ alleges Elevance (as Anthem), alongside Aetna and Humana, paid HUNDREDS OF MILLIONS OF DOLLARS in illegal kickbacks to insurance brokers (eHealth, GoHealth, SelectQuote) in exchange for steering Medicare beneficiaries into their plans — and, MORE SERIOUSLY (an allegation the DOJ makes against Aetna and Humana only, not Elevance), that Aetna and Humana specifically THREATENED TO WITHHOLD kickback payments to pressure brokers into enrolling FEWER DISABLED Medicare beneficiaries, whom the insurers considered less profitable, resulting in brokers rejecting referrals of and steering AWAY disabled beneficiaries from these plans — a serious disability-discrimination allegation layered on top of the kickback scheme. Aetna and GoHealth said they would defend 'vigorously' and Humana said it strongly disagrees; DOJ notes the claims are allegations only, with no determination of liability.

Contacts

Privacy contact. Not recorded.

Legal notice. PUBLIC COMPANY (ELV). Service route: c/o General Counsel / Corporate Secretary, Indianapolis, Indiana — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.

Mailing address. Not recorded.