HackingHealthcareFinancial ServicesHealthcareStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedDelayed DiscoveryPHIIdentity (basic)Government IDHealth (basic)MediumContained

CALIFORNIA PHYSICIANS' SERVICE

bd_306e4ea520f2a2e7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 31, 2018

Filed

Feb 15, 2019

To disclose

7 weeks

Affected

Not disclosed

Confidence

64%

Full breach record for CALIFORNIA PHYSICIANS' SERVICE →26 incidents on file

Blue Shield of California notified members that a third-party vendor, Sharecare Health Data Services, experienced unauthorized access to servers containing member personal information between May 21, 2018, and June 26, 2018. Data was exfiltrated to locations outside the US. Affected data included names, addresses, dates of birth, subscriber numbers (SSNs for some), and medical record numbers. Blue Shield learned of the incident on December 31, 2018, and mailed notices on February 15, 2019. Mandiant was engaged for forensic investigation, and the FBI was notified.

J jump to incidentP pin to compareR raw source

California clockDiscovered Dec 31, 2018 → Notified Feb 15, 201946d ✓ CA 60-day OK7 weeks discovery → filing

Incident timeline

undetected · 224 days

discovery → filing · 7 weeks / 46 days

May 21, 2018

Begins

Dec 31, 2018

Discovered

Feb 15, 2019

Filed

vs. sector median

3 wks faster

Part of Sharecare Health Data Services, LLC supply-chain incident (2019) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: CALIFORNIA PHYSICIANS' SERVICE
norm: california physicians service
Domain: blueshieldca.com

Name: CALIFORNIA PHYSICIANS' SERVICE
norm: california physicians service
Domain: blueshieldca.com
Also named: California Physicians' Servicedba oflegal entity
Blue Shield of Californiadba oftrade name
Industry: HealthcarellmFinancial Servicesllm

Discovered: Dec 31, 2018
Breach occurred: May 21, 2018 – Jun 26, 2018
Undetected for: 224 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 15, 2019
Affected individuals: Not disclosed
Data types: PHIIdentity (basic)Government IDHealth (basic)
Data elements: Social Security numberDate of birthMedical information
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified the FBI
Third party: via Sharecare Health Data Services

During the incident: Engaged Mandiant, a leading global forensic firm, to support its investigation of the breach
Notified the FBI and has been cooperating with its investigation
Retained a third party to implement 24/7 monitoring of its data systems
Refined its data retention policies
Improved its maintenance communications and protocols to ensure continuity across its network
Providing AllClear Credit Monitoring and Identity Repair services free of charge
Changes made: Implemented 24/7 monitoring of data systems
Refined data retention policies
Improved maintenance communications and protocols
Increased cybersecurity protections to meet Blue Shield's strict cybersecurity requirements
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(46 days from discovery to filing)
Compliance flags: CA 60-day OK · 46d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Dec 31, 2018
→ Notified: Feb 15, 2019
46d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Dec 31, 2018 → Notified: Feb 15, 2019	46d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-144778
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 15, 2019
Raw hash: 52649b1e2c705a107c744ac92c1231b6100a0433d78259ba60f59aac6834d9b8

Reporting entityCALIFORNIA PHYSICIANS' SERVICE

Victim entityCALIFORNIA PHYSICIANS' SERVICE

Incidentdiscovered Dec 31, 2018

Stated responseEngaged Mandiant, a leading global forensic firm, to support its investigation of the breach

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov