AccidentalHealthcareFinancial ServicesHealthcareMisconfigurationCustomer Data InvolvedEmployee Data InvolvedHealth (basic)Identity (basic)PIILowContained

BLUE CROSS AND BLUE SHIELD ASSOCIATION

bd_c7eac7fe44baf049 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 22, 2019

Filed

Dec 12, 2019

To disclose

7 weeks

Affected

54state residents only

Linked

2 filings

Confidence

64%

Full breach record for BLUE CROSS AND BLUE SHIELD ASSOCIATION →16 incidents on file

Blue Cross Blue Shield Service Benefit Plan notified Montana residents of a misconfiguration in the fepblue mobile app that inadvertently allowed adult family members to view summary claims information (pharmacy/medical) for other policyholders between Sept 28 and Oct 22, 2019. The issue was discovered and contained on Oct 22, 2019. No SSN, DOB, or financial data was exposed.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 24 days

discovery → filing · 7 weeks / 51 days

Sep 28, 2019

Begins

Oct 22, 2019

Discovered

Dec 12, 2019

Filed

vs. sector median

5 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

California State AGbd_78dfdb74dc4b65d42019-12-12Verified

Name: BLUE CROSS AND BLUE SHIELD ASSOCIATION
norm: blue cross and blue shield
Domain: fepblue.org
Industry: Health Insurance Carriers

Name: BLUE CROSS AND BLUE SHIELD ASSOCIATION
norm: blue cross and blue shield
Domain: fepblue.org
Industry: Health Insurance Carriers
Industry: HealthcarellmFinancial Servicesllm

Discovered: Oct 22, 2019
Breach occurred: Sep 28, 2019 – Oct 22, 2019
Undetected for: 24 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 54state-resident count only
Data types: Health (basic)Identity (basic)PII
Attack vector: Misconfiguration
MITRE ATT&CK: T1078 Valid Accounts
Regulator citations: Filed notice with Montana Office of the Attorney General

During the incident: Turned off the mobile app's claims viewing feature
Investigated the issue
Remediated the issue
Implemented steps to prevent a similar recurrence in the future
Changes made: Implemented steps to prevent a similar recurrence in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(51 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

California State AGDec 12 · first

Montana State AGDec 12 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-44.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 12, 2019
Raw hash: 9446b03233ce38f1604d6a4fb5382d094f204c3e6b0243d35330d67f3331f777

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityBLUE CROSS AND BLUE SHIELD ASSOCIATION

Victim entityBLUE CROSS AND BLUE SHIELD ASSOCIATION

Incidentdiscovered Oct 22, 2019

Stated responseTurned off the mobile app's claims viewing feature

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov