PhysicalHealthcareFinancial ServicesHealthcareTheftCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)PHICriticalActive

BLUECROSS BLUESHIELD OF TENNESSEE, INC.

bd_04f799971af2d3ff · schema v1 · pii pii-v1

Severity

Critical

Discovered

Oct 5, 2009

Filed

Mar 31, 2010

To disclose

25 weeks

Affected · nationwide

311,000724 in this filing

Confidence

66%

Full breach record for BLUECROSS BLUESHIELD OF TENNESSEE, INC. →11 incidents on file

BlueCross BlueShield of Tennessee reported the theft of 57 hard drives containing encoded (unencrypted) audio and video recordings of customer service calls. The theft occurred on Oct 2, 2009, and was discovered on Oct 5, 2009. Data included PHI, names, SSNs, and DOBs. Notification began Dec 7, 2009. ~311,000 individuals affected nationwide; 724 NH residents. Kroll OnTrack engaged for forensic review. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2 days

discovery → filing · 25 weeks / 177 days

Oct 2, 2009

Begins

Oct 5, 2009

Discovered

Mar 31, 2010

Filed

vs. sector median

+13 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed311,000 affectedView incident

Name: BLUECROSS BLUESHIELD OF TENNESSEE, INC.
norm: bluecross blueshield of tennessee
Domain: bcbst.com

Name: BLUECROSS BLUESHIELD OF TENNESSEE, INC.
norm: bluecross blueshield of tennessee
Domain: bcbst.com
Industry: HealthcarellmFinancial Servicesllm

Discovered: Oct 5, 2009
Breach occurred: Oct 2, 2009 – Oct 2, 2009
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 7, 2009
Affected individuals: 311,000state + nationwide
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial
Regulator citations: Reported theft to the Secretary of the United States Department of Health and Human Services (HHS)Provided periodic status updates to the Office of Civil Rights of HHSHHS is currently conducting a compliance review of BlueCrossNotified Tennessee’s Attorney GeneralNotified New Hampshire Attorney General

During the incident: Reported theft to law enforcement
Reported theft to the Secretary of the United States Department of Health and Human Services (HHS)
Notified Tennessee’s Attorney General
Hired Kroll OnTrack to aid in data restoration and review
Dedicated internal employees and hired temporary employees to aid in the review
Assigned potentially impacted members to risk tiers
Sent Tier 3 notification letters to members with Social Security numbers at risk
Mailed Tier 2 letters to approximately 311,000 members
Offered free credit monitoring through Equifax for one year to Tier 3 members
Engaged LifeLock for minors
Hired Kroll to send out notification letters and staff a telephone call center
Met with local State District Attorney
Placed information on its Web site
Obtaining an independent assessment of system-wide data and facility security
Changes made: Strengthened existing security measures at the Eastgate Town Center
Obtaining an independent assessment of system-wide data and facility security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(177 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/blue-cross-20100331.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 31, 2010
Raw hash: fd2df46d92ba94645d5bb3d2d015f0f9ee44b58be243bb2bc2accbe1384cbc44

Reporting entityBLUECROSS BLUESHIELD OF TENNESSEE, INC.

Victim entityBLUECROSS BLUESHIELD OF TENNESSEE, INC.

Incidentdiscovered Oct 5, 2009

Stated responseReported theft to law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov