HackingHealthcareFinancial ServicesHealthcareSupply Chain (3P Vendor)Customer Data InvolvedGovernment IDPIIMediumContained

BLUE CROSS OF IDAHO HEALTH SERVICE, INC.

bd_72b386b0753d0aac · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 3, 2021

Filed

Dec 8, 2021

To disclose

5 days

Affected · nationwide

2210 in this filing

Confidence

66%

Full breach record for BLUE CROSS OF IDAHO HEALTH SERVICE, INC. →3 incidents on file

Blue Cross of Idaho notified the Idaho AG that an external review vendor experienced a data breach on Nov 9, 2021. 22 members affected (10 in Idaho). SSNs likely involved. Vendor recovered data; no misuse found. Vendor handling notifications and credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 24 days

discovery → filing · 5 days

Nov 9, 2021

Begins

Dec 3, 2021

Discovered

Dec 8, 2021

Filed

vs. sector median

11 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed22 affectedView incident

Name: BLUE CROSS OF IDAHO HEALTH SERVICE, INC.
norm: blue cross of idaho health service

Name: BLUE CROSS OF IDAHO HEALTH SERVICE, INC.
norm: blue cross of idaho health service
Industry: HealthcarellmFinancial Servicesllm

Discovered: Dec 3, 2021
Breach occurred: Nov 9, 2021
Undetected for: 24 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 22state + nationwide
Data types: Government IDPII
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: Partner
Regulator citations: Notified Idaho Attorney General's Office
Initial access: supply_chain

During the incident: Vendor recovering data
Vendor providing affected members with personalized notification letter
Vendor providing free credit monitoring consistent with HIPAA requirements
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 days(5 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ag.idaho.gov/content/uploads/2022/03/12-08-21-Blue-Cross-of-Idaho.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 8, 2021
Raw hash: 872b579d792f6c5e03ff4c41aadc27ed39249b2610a709f56a7666d6af20df73

Reporting entityBLUE CROSS OF IDAHO HEALTH SERVICE, INC.

Victim entityBLUE CROSS OF IDAHO HEALTH SERVICE, INC.

Incidentdiscovered Dec 3, 2021

Stated responseVendor recovering data

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceag.idaho.gov