Anthem agrees to pay $115M to settle class action lawsuit over 2015 data breach in which hackers gained access to personal info of nearly 80M Americans
Anthem Inc. agreed to pay $115 million in a deal to end a court battle over the 2015 data breach where hackers gained access to sensitive records for nearly 80 million Americans.
Context & Ripple Effects
The settlement closes out the largest health-insurer breach on record: hackers took account information for as many as 80 million Anthem customers in early 2015, and Anthem later disclosed that up to 18.8 million Blue Cross Blue Shield members may also have been affected. The class action followed the playbook set by Target's $10 million settlement for its 2013 breach, but at more than ten times the payout.
The size matters because it resets expectations for breach litigation. When Equifax later settled its own class action for roughly $700 million, with $380.5 million ultimately approved for class members, the per-record cost of a mega-breach had moved decisively upward — and Anthem's $115 million was the step that showed courts would price eight-figure-member exposures far above retail-breach norms.
First-order effects
- Class members — nearly 80 million people whose names, birthdates, and account data were exposed — gain access to settlement funds, while Anthem books a nine-figure liability tied to a two-year-old incident.
- Anthem's legal exposure ends without any admission resolving how the intrusion happened, capping costs that had hung over the insurer since the February 2015 disclosure.
Second-order effects
- Health insurers and other holders of deep identity files face a new benchmark: litigation risk is now priced against member counts, not just remediation costs, raising the value of security spending ahead of a breach.
- Plaintiffs' firms get a proven template for aggregating tens of millions of affected individuals into one national class, which is exactly the structure Equifax faced when its own breach case consolidated.
Third-order effects
- Breach liability is becoming a standard, quantifiable line item for large data holders — a pattern running from Target through Anthem to Equifax and 23andMe — pushing boards to treat consumer-data protection as balance-sheet risk rather than an IT problem.
- If per-record payouts keep climbing, insurers and regulators have grounds to demand demonstrable safeguards before coverage and enforcement decisions, shifting the economics of holding large identity databases.
The trend: Class-action pricing of major data breaches is escalating from token payouts toward per-member-scale liabilities, making consumer-data custody a direct financial risk for large institutions.