Anthem has reached a $115 million deal to settle a class-action lawsuit over a 2015 data breach in which hackers stole personal information from 78.8 million employees and current and former members.
The settlement is the largest data-breach settlement ever. As part of the deal, Anthem will offer two years of credit protection to those affected—in addition to the two years of monitoring they already received—and will set aside funding for cybersecurity improvements, including modifying its current cybersecurity systems. It will also set aside $15 million to pay plaintiffs for out-of-pocket costs due to the breach.
The deal comes more than two years after Anthem announced hackers had gained access to its IT system. They stole the names, birthdates, Social Security numbers, addresses, and other information of tens of millions of people.
"As we have seen in cyberattacks against governments and private sector companies including Anthem over the past few years, many cyberthreat actors are increasingly sophisticated and determined adversaries," the company wrote in a statement. "Anthem is determined to do its part to prevent future attacks."
The settlement must be approved by a U.S. District Court in California.