Anthem attack seen bearing signature of China-backed hackers

"This goes well beyond trying to access health care records," Meyers said. "If you have a rich database of proclivities, health concerns and other personal information, it looks, from a Chinese intelligence perspective, as a way to augment human collection."

That doesn't mean that personal information wouldn't make its way to criminals, he cautioned, pointing to the possibility of moonlighting by hackers who work by day for China.

A different major U.S. health insurer was breached recently by Chinese hackers, according to a person involved in that investigation, who asked not to be identified because the matter is confidential. In that case, investigators concluded that the goal of the hack was to obtain information on the employees of a defense contractor that makes advanced avionics and other weaponry, said the person, who declined to identify the insurer.

The hackers first hijacked a translation website that the insurer's customer representatives used when dealing with foreign clients, using it to implant malware on the company's computers, the person said.

Hard targets

"A lot of these health care companies have a lot of very trusted relationships at the network level and the corporate level to some very hard targets on the federal side and the commercial side," said Orion Hindawi, co-founder and chief technology officer for Tanium Inc., a Berkeley, Calif.-based security firm that is used by banks, health care and other companies.

"The health care environment is in an unfortunate position: It didn't expect to be a high, heavy target five years ago, so they didn't prepare," Hindawi said. "They didn't expect to have advanced threats from nation-state actors targeting them."

Deep Panda

At Anthem, officials detected the theft of the trove of customer information as it was being sent from its computers on Jan. 29, according to one of the people.

Meyers said the breach fits the pattern of a hacking unit that Crowdstrike calls Deep Panda, which over the last several months has targeted both defense contractors and the health care industry. China appears to be putting together huge databases of individuals who might be intelligence targets, he said. Another example was the theft last year from a government agency of data on tens of thousands of employees who had applied for top-secret clearances, he said.

The Anthem investigation is young, several people involved cautioned, saying the final determination of the hackers' identity could ultimately change. The estimated number of customers whose data was stolen could also turn out to be lower, one of the people said.

U.S. intelligence officials have been increasingly concerned that repeated attacks on medical and pharmaceutical firms are at least in part efforts to obtain personal information for espionage purposes.

Two officials, who spoke on condition of anonymity to discuss classified efforts to pursue the attackers, said a number of the attacks came from the People's Liberation Army's Unit 61398. Five members of that Shanghai-based hacking unit were indicted by federal prosecutors last year.

Dual-purpose hack

A different and more sophisticated group attacked Anthem, based on initial indications, two people familiar with the investigation said.

Like many other Chinese hacking campaigns, the attacks appear to serve multiple purposes — one commercial and the other related to national security — said one of the U.S. officials. The attacks, this official and a former intelligence officer said, can test a firm's ability to protect intellectual property and financial information, while simultaneously stealing prescription records, medical treatment histories and other personal information that could be used to blackmail individuals to reveal national security and trade secrets.

The attacks apply new technology to some of the oldest espionage trade craft in the world, the former official added.

—With assistance from Julie Johnsson in Chicago and Richard Clough in New York.