California Physicians' Services
bd_970492f4cf7c2d6f · schema v1 · pii pii-v1
Full breach record for California Physicians' Services →Blue Shield of California notified members that a third-party subcontractor, Fortra, LLC, suffered a cybersecurity incident between January 28-31, 2023. An unauthorized individual accessed Fortra's GoAnywhere MFTaaS application and potentially exfiltrated files maintained by Blue Shield's provider, Brightline Medical Associates. Affected data included names, addresses, dates of birth, gender, subscriber IDs, phone numbers, emails, and plan information. No SSNs or financial data were accessed. Blue Shield locked communications with Brightline and offered one year of Experian IdentityWorks.
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_ee6a7f6e4dfb6cfdHHS OCRfiled 2023-04-04(4d gap)Verified
- bd_7469869418d10b62Maine State AGfiled 2023-03-27(4d gap)Verified
- bd_2a8212bd5ec634b7HHS OCRfiled 2023-04-05(5d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-564978
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 31, 2023
- Raw hash
- d49f76d5db70dbb9fb4bfbd95c3c9075fa1842aa9c19dbd58eb65d90eb4b64e8
Reporting entity
- Name
- California Physicians' Servicesnorm: california physicians
- Domain
- blueshieldca.com
Victim entity
- Name
- California Physicians' Servicesnorm: california physicians
- Domain
- blueshieldca.com
Incident
- Discovered
- Feb 5, 2023
- Materiality determined
- —
- Notification sent
- Mar 27, 2023
- Affected individuals
- Not disclosed
- Data types
- PHIIDENTITY_BASICHEALTH_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Third party
- via Fortra, LLC
Compliance
- Time to disclose
- 8 weeks(54 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 50d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Feb 5, 2023→ Notified: Mar 27, 202350d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.