Purdue, Anthem provide additional information on next steps following cyberattack

In the wake of the cyberattack on Anthem Inc., Purdue's medical plan administrator, the University has been working closely with Anthem to respond to employees' security concerns.

Starting Friday (Feb.13), current and former members whose information was included in the database that was compromised can visit AnthemFacts.com to learn how to enroll in two years of free credit monitoring and identity theft repair services provided by Anthem's vendor -- a leading and trusted identity protection provider. Members can access these services starting Friday, before receiving a mailed notification from Anthem that will be sent in the coming weeks.

The free identity protection services provided include two years of:

* Identity repair assistance: Should a member experience fraud, an investigator will do the work to recover financial losses, restore the member's credit, and ensure the member's identity is returned to its proper condition. This assistance will cover any fraud that has occurred since the incident first began.

* Credit monitoring: At no cost, members may also enroll in additional protections, including credit monitoring. Credit monitoring alerts consumers when banks and creditors use their identity to open new credit accounts.

* Child identity protection: Child-specific identity protection services also will be offered to any members with children insured through their plan.

* Identity theft insurance: For individuals who enroll, the company has arranged for $1,000,000 in identity theft insurance, where allowed by law.

* Identity theft monitoring/fraud detection: For members who enroll, data such as credit card numbers, social security numbers and emails will be scanned against aggregated data sources maintained by top security researchers that contain stolen and compromised individual data, in order to look for any indication that the members' data has been compromised.

* Phone alerts: Individuals who register for this service and provide their contact information will receive an alert when there is a notification from a credit bureau, or when it appears from identity theft monitoring activities that the individual's identity may be compromised.

Industry standards under similar circumstances are to provide credit monitoring services for one year; however, Anthem is exceeding these standards and providing these identity protection and credit monitoring services to all affected members for two years, in response to member concerns.

In addition to the information provided by Anthem, many faculty and staff have contacted Human Resources seeking additional information. The University has worked internally and with Anthem to provide the following responses:

* Does Purdue provide Social Security numbers to Anthem and, if so, why? Purdue provides PUIDs to Anthem as a primary identifier and Social Security numbers as a secondary identifier. Due to federal and state requirements, Anthem is required to collect Social Security numbers from Purdue.

* Is my credit card information safe? Purdue does not transmit any credit card information to Anthem. Anthem only has credit card information for those individuals who have purchased individual insurance policies.

* Will there be revised provider provisions in the future before a vendor is considered a viable provider? Purdue incorporates language into vendor contracts that are appropriate to the relationship and type of data being transferred, and that requires them to be in compliance with all applicable privacy and security regulations. ITaP conducts exercises to test the security systems of the University's business partners on a regular basis. Purdue's internal and external legal counsel provide periodic updates on changes in regulations and best practices and assist with contract review to ensure that appropriate security protection systems are incorporated into vendor contracts.

Purdue will continue to work closely with Anthem and provide additional information on the incident as it is made available.