AccidentalMisconfigurationData MishandlingCustomer Data InvolvedSupply Chain (3P Vendor)PHIHEALTH_BASICIDENTITY_BASICLowResolved
California Physicians' Services
bd_eb49b90f0e960bbc · schema v1 · pii pii-v1
Full breach record for California Physicians' Services →Blue Shield of California disclosed a misconfiguration in Google Analytics that allowed protected health information (PHI) to be shared with Google Ads between April 2021 and January 2024. The issue was discovered on February 11, 2025. Affected data includes insurance plan details, medical claim service dates, provider names, and patient financial responsibility. No malicious actor was involved; the exposure resulted from a vendor configuration error. Blue Shield severed the connection and reviewed security protocols.
California clockDiscovered Feb 11, 2025 → Notified Apr 4, 202552d ✓ CA 60-day OK8 weeks discovery → filing
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_c51ed35f3b80c4f2California State AGfiled 2025-06-06(58d gap)Candidate
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-601191
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Apr 9, 2025
- Raw hash
- 9d57afb2f7774c5191928dc1649b9588a99fb158dffe638586619bb632ee81e8
Reporting entity
- Name
- California Physicians' Servicesnorm: california physicians
- Domain
- blueshieldca.com
Victim entity
- Name
- California Physicians' Servicesnorm: california physicians
- Domain
- blueshieldca.com
Incident
- Discovered
- Feb 11, 2025
- Materiality determined
- —
- Notification sent
- Apr 4, 2025
- Affected individuals
- Not disclosed
- Data types
- PHIHEALTH_BASICIDENTITY_BASIC
- Attack vector
- Misconfiguration
- Third party
- via Google
Compliance
- Time to disclose
- 8 weeks(57 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 52d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Feb 11, 2025→ Notified: Apr 4, 202552d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.