HackingHealthcareFinancial ServicesHealthcareStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedPHIIdentity (basic)Health (basic)LowContained

California Physicians' Services d/b/a Blue Shield of California

bd_970492f4cf7c2d6f · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 5, 2023

Filed

Mar 31, 2023

To disclose

8 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

64%

Blue Shield of California notified members that a third-party subcontractor, Fortra, LLC, suffered a cybersecurity incident between January 28-31, 2023. An unauthorized individual accessed Fortra's GoAnywhere MFTaaS application and potentially exfiltrated files maintained by Blue Shield's provider, Brightline Medical Associates. Affected data included names, addresses, dates of birth, gender, subscriber IDs, phone numbers, emails, and plan information. No SSNs or financial data were accessed. Blue Shield locked communications with Brightline and offered one year of Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

California clockDiscovered Feb 5, 2023 → Notified Mar 27, 202350d ✓ CA 60-day OK8 weeks discovery → filing

Incident timeline

undetected · 8 days

discovery → filing · 8 weeks / 54 days

Jan 28, 2023

Begins

Feb 5, 2023

Discovered

Mar 31, 2023

Filed

vs. sector median

2 wks faster

This filing is one of 4 filings about the same incident.View merged incident

Part of FORTRA, LLC supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

HHS OCRbd_ee6a7f6e4dfb6cfd2023-04-04 · +4dVerified
Maine State AGbd_7469869418d10b622023-03-27 · +4dVerified
HHS OCRbd_2a8212bd5ec634b72023-04-05 · +5dVerified

Name: California Physicians' Services d/b/a Blue Shield of California
norm: california physicians services blue shield of california
Domain: blueshieldca.com

Name: California Physicians' Services d/b/a Blue Shield of California
norm: california physicians services blue shield of california
Domain: blueshieldca.com
Also named: California Physicians' Servicesdba oflegal entity
Blue Shield of Californiadba oftrade name
Industry: HealthcarellmFinancial Servicesllm

Discovered: Feb 5, 2023
Breach occurred: Jan 28, 2023 – Jan 31, 2023
Undetected for: 8 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 27, 2023
Affected individuals: Not disclosed
Data types: PHIIdentity (basic)Health (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Third party: via Fortra, LLC

During the incident: Fortra immediately deactivated the unauthorized user’s credentials
Fortra disabled the vulnerable application
Fortra rebuilt the application and gateway
Fortra removed all data we shared with Brightline from the GoAnywhere MFTaaS
Fortra notified law enforcement
Blue Shield immediately began an investigation into the matter
Blue Shield promptly locked communications between Blue Shield and our provider, Brightline
Changes made: Offering complimentary access to Experian IdentityWorks for one year
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(54 days from discovery to filing)
Compliance flags: CA 60-day OK · 50d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Feb 5, 2023
→ Notified: Mar 27, 2023
50d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Feb 5, 2023 → Notified: Mar 27, 2023	50d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 2 states

View merged incident ↗

Maine State AGMar 27 · first

California State AG+4d · this page

HHS OCR+8d

HHS OCR+9d

Pattern: first filing Mar 27 (ME), last Apr 5 (CA) — a 9-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-564978
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 31, 2023
Raw hash: d49f76d5db70dbb9fb4bfbd95c3c9075fa1842aa9c19dbd58eb65d90eb4b64e8

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityCalifornia Physicians' Services d/b/a Blue Shield of California

Victim entityCalifornia Physicians' Services d/b/a Blue Shield of California

Incidentdiscovered Feb 5, 2023

Stated responseFortra immediately deactivated the unauthorized user’s credentials

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov