AccidentalHealthcareFinancial ServicesHealthcareMisdeliveryCustomer Data InvolvedSupply Chain (3P Vendor)PHIHealth (basic)Identity (basic)Government IDMediumContained

Blue Cross Blue Shield of Michigan

bd_559e1901ce6a96ae · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 12, 2014

Filed

Jul 18, 2014

To disclose

5 weeks

Affected

1state residents only

Confidence

66%

Full breach record for Blue Cross Blue Shield of Michigan →3 incidents on file

Blue Cross Blue Shield of Michigan notified the NH AG of a data breach involving PHI and SSN of one NH resident. Two boxes of records were misplaced by a third-party storage facility. BCBSM arranged one year of identity theft protection for the affected individual.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 131 days

discovery → filing · 5 weeks / 36 days

Feb 1, 2014

Begins

Jun 12, 2014

Discovered

Jul 18, 2014

Filed

vs. sector median

7 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Blue Cross Blue Shield of Michigan
norm: blue cross blue shield of michigan
Domain: bcbsm.com

Name: Blue Cross Blue Shield of Michigan
norm: blue cross blue shield of michigan
Domain: bcbsm.com
Industry: HealthcarellmFinancial Servicesllm

Discovered: Jun 12, 2014
Breach occurred: Feb 1, 2014 – May 1, 2014
Undetected for: 131 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 21, 2014
Affected individuals: 1state-resident count only
Data types: PHIHealth (basic)Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Regulator citations: Notified New Hampshire Attorney General

During the incident: Began working immediately with the agency to investigate the incident
Arranged for identity theft protection services for affected members to be provided by AllClear ID
Covering the cost of these services for one year
Consideration of a new storage vendor
Changes made: Consideration of a new storage vendor
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(36 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/blue-cross-20140718.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 18, 2014
Raw hash: ab89d49592938269da6dec5740f81e67a3432104292ad566a3b9b7619375cf1c

Reporting entityBlue Cross Blue Shield of Michigan

Victim entityBlue Cross Blue Shield of Michigan

Incidentdiscovered Jun 12, 2014

Stated responseBegan working immediately with the agency to investigate the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov