Premera said yesterday that it learned on January 29 that the company had been the victim of a "sophisticated attack" to get into its computer network.
An investigation found that the initial attack occurred on May 5, 2014.
The company said hackers may have been able to access members' names, dates of birth, social security numbers, email addresses, bank account data and medical claims information.
Including customers and contractors, the total number of people affected could be 11 million, Premera said.
Also Read
"The security of Premera's members' personal information remains a top priority. We at Premera take this issue seriously and sincerely regret the concern it may cause," said Premera chief executive Jeff Roe.
"As much as possible, we want to make this event our burden, not that of the affected individuals, by making services available today to help protect people's information."
Reports last month said China may have been behind the Anthem hack, a claim that was denied by Beijing.
The Anthem cyberattack was the latest where US investigators say evidence points to China.
FBI Director James Comey said in October that China was at the "top of the list" of countries launching cyberattacks on US firms.
Some experts say medical data can be even more lucrative to hackers than credit cards because they can create fake identities for other frauds schemes.