HackingHealthcareTechnologyHealthcareVulnerability ExploitStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedBusiness Associate (HIPAA)Identity (basic)LowContained

Blue Shield of California

bd_a6884d47e386af7d · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 26, 2023

Filed

Jan 4, 2024

To disclose

23 weeks

Affected

Not disclosed

Confidence

65%

Welltok, Inc., a third-party service provider for Blue Shield of California, disclosed that an unknown actor exploited software vulnerabilities in its MOVEit Transfer server on May 30, 2023, exfiltrating data including names and other personal information. Welltok was alerted to the compromise on July 26, 2023. The incident affects Blue Shield members. Welltok is offering credit monitoring services.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jul 26, 2023 → Notified Dec 21, 2023148d ✗ CA 60-day late23 weeks discovery → filing

Incident timeline

undetected · 57 days

discovery → filing · 23 weeks / 162 days

May 30, 2023

Begins

Jul 26, 2023

Discovered

Jan 4, 2024

Filed

vs. sector median

+14 wks slower

Part of Welltok supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Welltok
norm: welltok
Domain: welltok.com

Name: Blue Shield of California
norm: blue shield of california
Domain: blueshieldca.com
Industry: HealthcarellmTechnologyllm

Discovered: Jul 26, 2023
Breach occurred: May 30, 2023
Undetected for: 57 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 21, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1195 Supply Chain Compromise
Threat actor: External
Third party: via Welltok, Inc.
Initial access: supply_chain

During the incident: Launched an additional investigation with the assistance of third-party cybersecurity specialists
Conducted a full reconstruction of systems and historical data
Coordinated efforts with Blue Shield to review and verify the affected information
Provided direct notice to impacted individuals
Offering complimentary access to Experian IdentityWorks
Changes made: Reviewing and enhancing existing policies and procedures related to data privacy
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 weeks(162 days from discovery to filing)
Compliance flags: CA 60-day late · 148d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jul 26, 2023
→ Notified: Dec 21, 2023
148d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jul 26, 2023 → Notified: Dec 21, 2023	148d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-578830
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 4, 2024
Raw hash: 97c498cf78ae6b884fe6c4ae2c475386cb0234ed8e4522555ad9c786dac3ef6c

Reporting entityWelltok

Victim entityBlue Shield of California

Incidentdiscovered Jul 26, 2023

Stated responseLaunched an additional investigation with the assistance of third-party cybersecurity specialists

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov