AccidentalHealthcareFinancial ServicesHealthcareProgramming ErrorMisconfigurationCustomer Data InvolvedSupply Chain (3P Vendor)PHIHealth (basic)Identity (basic)LowResolved

BLUE CROSS AND BLUE SHIELD ASSOCIATION

bd_78dfdb74dc4b65d4 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 22, 2019

Filed

Dec 12, 2019

To disclose

7 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Full breach record for BLUE CROSS AND BLUE SHIELD ASSOCIATION →16 incidents on file

Blue Cross Blue Shield Association disclosed that a vendor's programming change on September 28, 2019, inadvertently altered permission functionalities in the fepblue mobile app. This error allowed adult family members on a policy contract to view summary medical and pharmacy claims information for other members between September 28 and October 22, 2019, even without affirmative permission. The issue was discovered on October 22, 2019, when the claims viewing feature was turned off. Affected data included names, addresses, insurance IDs, claim details, and drug information. SSNs, DOBs, and financial data were not involved. No misuse was reported.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 24 days

discovery → filing · 7 weeks / 51 days

Sep 28, 2019

Begins

Oct 22, 2019

Discovered

Dec 12, 2019

Filed

vs. sector median

5 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Montana State AGbd_c7eac7fe44baf0492019-12-12Candidate

Name: BLUE CROSS AND BLUE SHIELD ASSOCIATION
norm: blue cross and blue shield
Domain: fepblue.org

Name: BLUE CROSS AND BLUE SHIELD ASSOCIATION
norm: blue cross and blue shield
Domain: fepblue.org
Industry: HealthcarellmFinancial Servicesllm

Discovered: Oct 22, 2019
Breach occurred: Sep 28, 2019 – Oct 22, 2019
Undetected for: 24 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Third-Party / Supply Chain
Third party: via Blue Cross Blue Shield Association Service Benefit Plan vendor

During the incident: Turned off the mobile app’s claims viewing feature
Investigated and remediated the issue
Taken appropriate steps to correct the issue
Changes made: Implemented steps to prevent a similar recurrence in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(51 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGDec 12 · first

California State AGDec 12 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-185087
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 12, 2019
Raw hash: 44dadf9148dbaae01b32c8fb592a1e41a3548ecad1c3454fc0460d0bb5ca9234

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityBLUE CROSS AND BLUE SHIELD ASSOCIATION

Victim entityBLUE CROSS AND BLUE SHIELD ASSOCIATION

Incidentdiscovered Oct 22, 2019

Stated responseTurned off the mobile app’s claims viewing feature

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov