CareFirst announced Wednesday that up to 1.1 million individuals, but current and former plan holders, may have been affected by the security breakthrough.