Experts are speculating that attackers exploited a vulnerability in Anthems IT system, or obtained credentials via social engineering.