Here's official statement (got an email from BCBS with same content): http://anthemfacts.com/

The biggest question I have is why such sensitive data was not encrypted.