I guess we will never really know how sophisticated the attack was, but my guess is it was not very complex. Someone probably got phished, and from their the attacker could move around in the network to find the interesting data.
http://krebsonsecurity.com/2015/02/data-breach-at-health-insurer-anthem-could-impact-millions/