AccidentalHealthcareFinancial ServicesHealthcareMisdeliveryCustomer Data InvolvedPHIHealth (basic)Identity (basic)LowResolved

CareFirst Blue Cross Blue Shield

bd_9709918157a1d64d · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 3, 2025

Filed

Mar 19, 2025

To disclose

6 weeks

Affected

1state residents only

Confidence

68%

Full breach record for CareFirst Blue Cross Blue Shield →5 incidents on file

CareFirst BlueCross BlueShield notified the Maryland AG of a misdelivery incident on March 19, 2025. On Feb 3, 2025, an employee erroneously attached one member's PHI (name, DOB, ID, health record, medication) to another member's appeal letter. One Maryland resident was impacted. CareFirst offered 2 years of Experian IdentityWorks and retrained the employee.

J jump to incidentP pin to compareR raw source

Maryland clock⏱ MD AG >30d6 weeks discovery → filing

Incident timeline

discovery → filing · 6 weeks / 44 days

Feb 3, 2025

Discovered

Mar 19, 2025

Filed

vs. sector median

6 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: CareFirst Blue Cross Blue Shield
norm: carefirst blue cross blue shield
Domain: carefirst.com

Name: CareFirst Blue Cross Blue Shield
norm: carefirst blue cross blue shield
Domain: carefirst.com
Industry: HealthcarellmFinancial Servicesllm

Discovered: Feb 3, 2025
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: PHIIdentity (basic)Health (basic)
Attack vector: Misconfiguration
Threat actor: Internal
Regulator citations: Notified Maryland Office of the Attorney General

During the incident: Offering a free two (2) year membership in Experian’s® IdentityWorksSM
Notifying the impacted individuals
Employee involved in this incident received the appropriate counseling and re-training
Changes made: Employee involved in this incident received the appropriate counseling and re-training
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(44 days from discovery to filing)
Compliance flags: MD AG >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376573.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 19, 2025
Raw hash: 2cd6e1afd43bc5369524deba88816d797929f6400522e944d7c5d49a364e6a36

Reporting entityCareFirst Blue Cross Blue Shield

Victim entityCareFirst Blue Cross Blue Shield

Incidentdiscovered Feb 3, 2025

Stated responseOffering a free two (2) year membership in Experian’s® IdentityWorksSM

ComplianceMD AG >30d

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov