AccidentalHealthcareFinancial ServicesHealthcareMisdeliveryCustomer Data InvolvedPHIHealth (basic)Identity (basic)LowResolved

Blue Shield of California

bd_da8d40287627423a · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 25, 2025

Filed

Jun 23, 2025

To disclose

8 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Blue Shield of California disclosed an incident on April 25, 2025, where a customer service agent accidentally filtered a search and emailed protected health information (PHI) belonging to multiple members to an unauthorized recipient. The PHI included names, subscriber IDs, group numbers, account numbers, claim numbers, procedure codes, addresses, and doctor information. No SSNs or financial data were involved. The recipient reported the error immediately. Blue Shield disabled the encryption key, attempted to contact the recipient, educated the employee, and updated procedures. Affected individuals are offered one year of Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

California clockDiscovered Apr 25, 2025 → Notified Jun 23, 202559d ✓ CA 60-day OK8 weeks discovery → filing

Incident timeline

discovery → filing · 8 weeks / 59 days

Apr 25, 2025

Begins

Apr 25, 2025

Discovered

Jun 23, 2025

Filed

vs. sector median

1 wks faster

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_a1943989c510a3622025-06-23Verified by operator

Name: Blue Shield of California
norm: blue shield of california
Domain: blueshieldca.com

Name: Blue Shield of California
norm: blue shield of california
Domain: blueshieldca.com
Industry: HealthcarellmFinancial Servicesllm

Discovered: Apr 25, 2025
Breach occurred: Apr 25, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 23, 2025
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Unknown

During the incident: Disabled the encryption key so the recipient is no longer able to access the email
Made several attempts to contact the individual that received the information in error
Provided education to the employee that made the error
Updated Customer Service Department procedures to prevent similar occurrences in the future
Offering complimentary access to Experian IdentityWorks for one year
Changes made: Updated Customer Service Department procedures to prevent similar occurrences in the future
Provided education to the employee that made the error
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: CA 60-day OK · 59d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Apr 25, 2025
→ Notified: Jun 23, 2025
59d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Apr 25, 2025 → Notified: Jun 23, 2025	59d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRJun 23 · first

California State AGJun 23 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-604392
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 23, 2025
Raw hash: a42a5fb17b40d5289c825d51f578fa704ba71023ebf39bd2113194a545e6d2f5

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityBlue Shield of California

Victim entityBlue Shield of California

Incidentdiscovered Apr 25, 2025

Stated responseDisabled the encryption key so the recipient is no longer able to access the email

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov