AccidentalMisdeliveryCustomer Data InvolvedPHIIDENTITY_BASICHEALTH_BASICLowResolved
CareFirst Blue Cross Blue Shield
bd_9709918157a1d64d · schema v1 · pii pii-v1
Full breach record for CareFirst Blue Cross Blue Shield →CareFirst BlueCross BlueShield notified the Maryland AG of a misdelivery incident on March 19, 2025. On Feb 3, 2025, an employee erroneously attached one member's PHI (name, DOB, ID, health record, medication) to another member's appeal letter. One Maryland resident was impacted. CareFirst offered 2 years of Experian IdentityWorks and retrained the employee.
Maryland clock⏱ MD AG >30d6 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident
Source provenance
- Source URL
- https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376573.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 19, 2025
- Raw hash
- 2cd6e1afd43bc5369524deba88816d797929f6400522e944d7c5d49a364e6a36
Reporting entity
- Name
- CareFirst Blue Cross Blue Shieldnorm: carefirst blue cross blue shield
- Domain
- carefirst.com
Victim entity
- Name
- CareFirst Blue Cross Blue Shieldnorm: carefirst blue cross blue shield
- Domain
- carefirst.com
Incident
- Discovered
- Feb 3, 2025
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- 1
- Data types
- PHIIDENTITY_BASICHEALTH_BASIC
- Attack vector
- Misconfiguration
- Threat actor
- Internal
- Regulator citations
- Notified Maryland Office of the Attorney General
Compliance
- Time to disclose
- 6 weeks(44 days from discovery to filing)
- Compliance flags
- MD AG >30d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.