Got the letter yesterday. The one everybody with an Anthem plan, or a Blue Cross plan running under Anthem's umbrella, has probably gotten by now or will in the next few weeks — the "we're very sorry, but your Social Security number might be out there now" letter. Anthem disclosed the breach on February 4th, and I guess my name came up somewhere in the mail queue around week two.
If you haven't heard: this is the health insurance breach, not a store breach, not a bank breach. Names, birthdays, SSNs, addresses, income info, employment details, reportedly up to 80 million people's worth. No credit card numbers, no actual medical claims data, which is apparently supposed to make me feel better. It doesn't, really. My SSN doesn't expire and I can't get a new one just because some server in Indianapolis got walked into.
So yesterday I spent my lunch break on hold with Experian.
I want to talk about that part specifically, because everyone's already written the "biggest healthcare breach on record" post this week and I don't have anything new to add to that particular pile. What I do have is forty-five minutes of hold music and a system that somehow makes doing the responsible thing, freezing your credit, feel like it's actively trying to talk you out of it.
Here's the part nobody warns you about: you can't just do it once. It's three separate calls to three separate agencies, Equifax, Experian, and TransUnion, three separate PINs you will absolutely lose within a month, and at least one of them wants to mail you something instead of letting you finish online. Mail. In 2015. To freeze a file so nobody can open a line of credit using data that got stolen over the internet in the first place. I said as much to the woman on the phone, who has clearly heard that joke about four thousand times already this week and did not laugh.
Anthem's offering free credit monitoring through a company called AllClear ID, two years of it. I signed up on autopilot, the way you click through a EULA without reading it. I don't actually think monitoring does that much for a stolen SSN once it's loose — the number's out there permanently now, monitoring just tells you after somebody's already used it. Feels a little like locking the barn door after somebody's already sold the horse's location to anyone who asks.
Small tangent, but weeks like this make me glad I finally moved everything into LastPass last year instead of reusing the same three passwords across forty different sites like some kind of animal. It doesn't help with an SSN leak, nothing really does, but at least my actual accounts aren't lined up like dominoes anymore. If you're still on the reuse plan, this is as good a nudge as any to stop.
Completely unrelated, but Apple crossed $700 billion in market cap this week, which is a number so large it stopped meaning anything to me somewhere around $200 billion. I only bring it up because it's funny to sit here worrying about whether someone on a forum has my mother's maiden name while the most valuable company on the planet mostly sells me the phone I use to worry about it on.
If you're on an Anthem-affiliated plan, and it turns out they run under a lot of different Blue Cross brand names depending on your state, which I didn't know until this week either, go check your mailbox, or just call them instead of waiting on the letter. Budget more than a lunch break for the freeze calls themselves. I'm two agencies down, one to go, and I still don't have all three PINs written down anywhere that isn't a sticky note on my monitor, which is its own small betrayal of everything I just said about LastPass two paragraphs ago.