Humana

Kentucky-based health insurer Humana surprised us with a new type of attack. Humana’s technology team became suspicious after there were a number of calls to their IVR, where the caller was able to authenticate as a member by providing date of birth, zip code, and Humana ID number or Social Security Number, but then dropped the call and didn’t go any further. Humana blocked the phone numbers associated with the suspicious calls, notified their members, and offered them protective services through Equifax’s Credit Watch Gold service. And of course, they continue to monitor for any other suspicious behavior.

Health insurer Humana recently began notifying an unspecified number of health plan members after detecting and blocking a credential stuffing attack against Humana.com and Go365.com. The attacks took place on June 3 and June 4 from overseas IP addresses.