SHARE THIS ARTICLE Share Tweet Post Email 
 
 Investigators of Anthem Inc.’s data breach are pursuing evidence that points to Chinese state-sponsored hackers who are stealing personal information from health-care companies for purposes other than pure profit, according to three people familiar with the probe. 
 
 The breach, which exposed Social Security numbers and other sensitive details of 80 million customers, is one of the biggest thefts of medical-related customer data in U.S. history. 
 
 The attack appears to follow a pattern of thefts of medical data by foreigners seeking a pathway into the personal lives and computers of a select group -- defense contractors, government workers and others, according to a U.S. government official familiar with a more than year-long investigation into the evidence of a broader campaign. 
 
 The Anthem theft follows breaches of companies including Target Corp., Home Depot Inc. and JPMorgan Chase & Co. that have touched the private data of hundreds of millions of Americans and increased pressure on the U.S. government to respond more forcefully. Though President Barack Obama promised action against North Korea after the destruction of property at Sony Pictures Entertainment, corporations and the government have struggled to come up with appropriate responses to attacks that fall into a gray area between espionage and crime. 
 
 ‘Phishing’ Attacks 
 
 Technical details of the attack include “fingerprints” of a nation-state, according to two people familiar with the investigation, who said China is the early suspect. 
 
 The Federal Bureau of Investigation is leading the investigation, according to Anthem, which has hired FireEye Inc., a Milpitas, California-based security company, to assist. 
 
 China has said in the past that it doesn’t conduct espionage through hacking. The Chinese embassy in Washington didn’t immediately respond to a request for comment. 
 
 Hackers could use stolen information -- which Anthem said in its case included birthdates and e-mail addresses -- to conduct “phishing” attacks on customers who unwittingly provide access to their companies’ networks. Government officials have been investigating whether foreign interests are using personal, financial or medical information as leverage to gain intelligence from people who want their information to stay private, according to the U.S. official. 
 
 Adviser Hacked 
 
 Michael Daniel, President Obama’s chief adviser on cybersecurity, is an an Anthem customer who would be resetting his password, he said in a Bloomberg Web seminar early Thursday. 
 
 Among those insured by Anthem have been employees of Northrop Grumman Corporation, according to the insurer’s website, while the company has processed claims for workers at The Boeing Company in Missouri. Boeing has about 15,000 workers in Missouri, where the company’s defense unit is based. Those and other defense contractors could be of interest to foreign intelligence organizations. 
 
 Anthem spokeswoman Kristin Binns declined to comment. 
 
 John Dern, a spokesman for Boeing, and Mark Root, a spokesman for Northrop Grumman, didn’t immediately comment. Jenny Shearer, a spokeswoman for the FBI, declined to comment. 
 
 Building Profiles 
 
 In the past year, Chinese-sponsored hackers have taken prescription drug and health records and other information that could be used to create profiles of possible spy targets, according to Adam Meyers, vice president of intelligence at Crowdstrike, an Irvine, Califorinia-based cybersecurity firm. He declined to name any of the companies affected. 
 
 “This goes well beyond trying to access health-care records,” Meyers said. “If you have a rich database of proclivities, health concerns and other personal information, it looks, from a Chinese intelligence perspective, as a way to augment human collection.” 
 
 That doesn’t mean that personal information wouldn’t make its way to criminals, he cautioned, pointing to the possibility of moonlighting by hackers who work by day for China. 
 
 A different major U.S. health insurer was breached recently by Chinese hackers, according to a person involved in that investigation, who asked not to be identified because the matter is confidential. In that case, investigators concluded that the goal of the hack was to obtain information on the employees of a defense contractor that makes advanced avionics and other weaponry, said the person, who declined to identify the insurer. 
 
 The hackers first hijacked a translation website that the insurer’s customer representatives used when dealing with foreign clients, using it to implant malware on the company’s computers, the person said. 
 
 Hard Targets 
 
 “A lot of these healthcare companies have a lot of very trusted relationships at the network level and the corporate level to some very hard targets on the federal side and the commercial side,” said Orion Hindawi, co-founder and chief technology officer for Tanium Inc., a Berkeley, California-based security firm that is used by banks, healthcare and other companies. 
 
 “The healthcare environment is in an unfortunate position: It didn’t expect to be a high, heavy target five years ago, so they didn’t prepare,” Hindawi said. “They didn’t expect to have advanced threats from nation-state actors targeting them.” 
 
 Deep Panda 
 
 At Anthem, officials detected the theft of the trove of customer information as it was being sent from its computers on Jan. 29, according to one of the people. 
 
 Meyers said the breach fits the pattern of a hacking unit that Crowdstrike calls Deep Panda, which over the last several months has targeted both defense contractors and the health care industry. China appears to be putting together huge databases of individuals who might be intelligence targets, he said. Another example was the theft last year from a government agency of data on tens of thousands of employees who had applied for top-secret clearances, he said. 
 
 The Anthem investigation is young, several people involved cautioned, saying the final determination of the hackers’ identity could ultimately change. The estimated number of customers whose data was stolen could also turn out to be lower, one of the people said. 
 
 U.S. intelligence officials have been increasingly concerned that repeated attacks on medical and pharmaceutical firms are at least in part efforts to obtain personal information for espionage purposes. 
 
 Two officials, who spoke on condition of anonymity to discuss classified efforts to pursue the attackers, said a number of the attacks came from the People’s Liberation Army’s Unit 61398. Five members of that Shanghai-based hacking unit were indicted by federal prosecutors last year. 
 
 Dual-Purpose Hack 
 
 A different and more sophisticated group attacked Anthem, based on initial indications, two people familiar with the investigation said. 
 
 Like many other Chinese hacking campaigns, the attacks appear to serve multiple purposes -- one commercial and the other related to national security -- said one of the U.S. officials. The attacks, this official and a former intelligence officer said, can test a firm’s ability to protect intellectual property and financial information, while simultaneously stealing prescription records, medical treatment histories and other personal information that could be used to blackmail individuals to reveal national security and trade secrets. 
 
 The attacks apply new technology to some of the oldest espionage trade craft in the world, the former official added. ||||| The database of Indianapolis-based health insurer Anthem, which containing personal information for about 80 million customers and employees, has been hacked. WSJ's Stefanie Ilgenfritz reports. Photo: AP 
 
 Anthem Inc. ANTM 0.34 % stored the Social Security numbers of 80 million customers without encrypting them, the result of what a person familiar with the matter described as a difficult balancing act between protecting the information and making it useful. 
 
 Scrambling the data, which included addresses and phone numbers, could have made it less valuable to hackers or harder to access in bulk. It also would have made it harder for Anthem employees to track health care trends or share data with states and health providers, that person said. 
 
 The risks became clear last week, when Anthem discovered that hackers had broken into the database and made off with information on tens of millions of consumers, likely making it the largest computer breach disclosed by a health-care company. 
 
 Because the data wasn’t encrypted, it would be easily readable by hackers. The company believes a hacker group used a stolen employee password to access the database. 
 
 That storage decision has made the country’s second-largest health insurer the latest poster child for a continuing debate in executive suites: Is turning a corporate network into an electronic Fort Knox worth the potential cost? 
 
 Companies can employ random pass codes, limit access from outside the office or use complex math to scramble data. But those things slow companies down, sometimes to a degree they find unacceptable. 
 
 There is no evidence yet that identify thieves are using the data stolen from Anthem, it said. On Thursday, investigators began to focus on links to a group in China. Although the investigation remains in its early stages, the Anthem hack relied on malware and tools that have been used almost exclusively by Chinese cyberspies, investigators said. 
 
 At a daily press briefing on Friday, Chinese Foreign Ministry spokesman Hong Lei said the idea that the hackers were Chinese is “groundless,” and reiterated Beijing’s stance that the country is a victim and not a perpetrator of cyberattacks. “We maintain a cooperative, open and secure cyberspace, and we hope that countries around the world will make concerted efforts to that end,” he said. 
 
 Employers and government agencies “require us to maintain a member’s Social Security number in our systems so that their systems can uniquely identify their members,” Anthem spokeswoman Kristin Binns said. Ms. Binns said Anthem encrypts personal data when it moves in or out of its database but not when it is stored, which is common in the industry. 
 
 “We use other measures, including elevated user credentials, to limit access to the data when it is residing in a database,” she said. 
 
 ENLARGE Anthem said it is likely that ‘tens of millions’ of records were stolen. Photo: Darron Cummings/Associated Press 
 
 “We join you in your concern and frustration,” Anthem Chief Executive Joseph Swedish said in a letter posted on the company’s website. “I assure you that we are working around the clock to do everything we can to further secure your data.” He didn’t provide details. 
 
 Adam Greene, a privacy attorney with the law firm Davis Wright Tremaine LLP and former official in the U.S. Department of Health and Human Services, said encryption isn’t a cure-all for data breaches. 
 
 “At some point, that information is going to be used in an unencrypted state and if a hacker has access to it at that point, the information could be exposed,” Mr. Greene said. 
 
 Last month, New Jersey Gov. Chris Christie signed a law requiring health insurers operating in the state to encrypt client information, including Social Security numbers, driver’s license numbers, addresses and identifiable health information. The law was prompted in part by a breach of 840,000 individuals’ information from Horizon Blue Cross Blue Shield of New Jersey in 2013, following the theft of two laptops containing unencrypted data. 
 
 Anthem doesn’t sell plans in New Jersey. 
 
 Health insurers don’t always encrypt members’ data, and aren’t required by the federal Health Insurance Portability and Accountability Act to encrypt data. 
 
 Under HIPAA, doctors, hospitals, health plans and others must “address” encryption in their operations, but don’t have to scramble data if they determine doing so would impose an unreasonable burden, the likelihood of disclosure is low and they have implemented alternative security measures. 
 
 Mr. Greene, the privacy attorney, said repeated breaches show that the risk of disclosure isn’t low. 
 
 Health and Human Services’ Office for Civil Rights, which enforces HIPAA, is urging providers and insurers to encrypt as much data as possible. The office didn’t respond to a request for comment on Thursday. 
 
 The office has imposed penalties or reached settlements in 24 data-breach cases in recent years, including two in April 2014 involving lack of encryption. Concentra Health Services unit of Humana Inc. HUM -0.77 % agreed to pay $1.7 million after an unencrypted laptop was stolen from one of its facilities. The same month, QCA Health Plan Inc. of Arkansas agreed to pay $250,000 to settle potential HIPAA violations after an unencrypted laptop containing information on 148 individuals was stolen. 
 
 HHS’s Office for Civil Rights said at the time: “Our message to these organizations is simple: encryption is your best defense against these incidents.” 
 
 Write to Danny Yadron at danny.yadron@wsj.com
– The Anthem hack that exposed 80 million Americans' data bears "fingerprints" of a nation-state, and investigators are chasing evidence that that nation-state is China, reports Bloomberg. And the attackers aren't necessarily after a credit-card shopping spree: Rather, security experts and government officials say that it appears to be part of an overarching strategy aimed at developing a deep catalog of the data of certain Americans—and defense contractors and government workers appear to be prime targets. "This goes well beyond trying to access health-care records," says a VP of a cybersecurity firm. "If you have a rich database of proclivities, health concerns, and other personal information, it looks, from a Chinese intelligence perspective, as a way to augment human collection." The White House's own chief adviser on cybersecurity said he was among those whose data was compromised; Anthem also insures Boeing and other defense contractors, notes Bloomberg. Sources close to the investigation—which is being run by the FBI and FireEye—say that the techniques and malicious code have near-exclusive ties to China, reports the Wall Street Journal. Meanwhile, the AP has a list of things hacking victims can do to protect themselves.