MICHIGANHackingHealthcareHealthcarePhishingStolen CredentialsBusiness Associate (HIPAA)Customer Data InvolvedGovernment IDIdentity (basic)PHIMediumContained

Blue Cross Blue Shield of Michigan

bd_7e2f70b6dfe66318 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

May 19, 2014

To disclose

—

Affected

502

Confidence

69%

Full breach record for Blue Cross Blue Shield of Michigan →3 incidents on file

Blue Cross Blue Shield of Michigan Blue Care Network reported to HHS on 2014-05-19 a Unauthorized Access/Disclosure affecting 502 individuals. Breached information located on Email. An external party accessed a BA employee's email and sent a phishing link to contacts, exposing PHI including SSNs, addresses, DOBs, and phone numbers. The business associate, Bloom Health, contained the incident and implemented MFA.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS notified

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

⚠ No discovery dateThe OCR public portal omits the discovery date, so the 60-day notification clock cannot be evaluated from this source — only that the filing was submitted.

Incident timeline — partial

? — ?

Breach window unknown

May 19, 2014

Filed

—

No filing yet · watching

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed502 affectedView incident

Name: Blue Cross Blue Shield of Michigan
norm: blue cross blue shield of michigan
Industry: Health Care Services

Name: Blue Cross Blue Shield of Michigan
norm: blue cross blue shield of michigan
Industry: Healthcaresource default

Discovered: Not extracted — the OCR public portal omits it
Materiality determined: —
Notification sent: —
Affected individuals: 502nationwide
Data types: Government IDIdentity (basic)PHI
HHS breach type: Unauthorized access or disclosure
Where the data lived: Email
Covered-entity type: Business associate
Attack vector: Unauthorized Access
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified HHSOCR obtained documented assurances that the BA implemented the voluntary compliance actions
Third party: via Bloom Healthbusiness associate
Initial access: phishing_link

During the incident: Shut down the affected laptop computer
Conducted forensic reviews
Sent emails to employees and business partners about the suspicious email
Instructed employees not to click on the embedded link
Instructed employees to change email passwords
Provided breach notification to HHS
Provided breach notification to affected individuals
Posted substitute notice on its website
Retrained its staff on its new policies and procedures
Changes made: Implemented a new policy to require a forced password reset after an account has been locked
Implemented two-factor authentication for all business emails
Source: Quoted from the filing itself, not independently verified.

Compliance flags: HHS notified
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: not extracted
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: not extracted → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: May 19, 2014
Raw hash: 181704435de2d103280acabfd36b9da1a191cae05c24e92d85b3c8fc08a909d4

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.2 KB

Download View at source

Reporting entityBlue Cross Blue Shield of Michigan

Victim entityBlue Cross Blue Shield of Michigan

IncidentUnauthorized Access

Stated responseShut down the affected laptop computer

ComplianceHHS notified

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing