DisclosureLens
AccidentalHealthcareFinancial ServicesHealthcareMisconfigurationData MishandlingCustomer Data InvolvedSupply Chain (3P Vendor)PHIHealth (basic)Identity (basic)LowResolved

Blue Shield of California

bd_eb49b90f0e960bbc · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 11, 2025

Filed

Apr 9, 2025

To disclose

8 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Blue Shield of California disclosed a misconfiguration in Google Analytics that allowed protected health information (PHI) to be shared with Google Ads between April 2021 and January 2024. The issue was discovered on February 11, 2025. Affected data includes insurance plan details, medical claim service dates, provider names, and patient financial responsibility. No malicious actor was involved; the exposure resulted from a vendor configuration error. Blue Shield severed the connection and reviewed security protocols.

California clockDiscovered Feb 11, 2025 → Notified Apr 4, 202552d ✓ CA 60-day OK8 weeks discovery → filing

Incident timeline

undetected · 1412 days
discovery → filing · 8 weeks / 57 days

Apr 1, 2021

Begins

Feb 11, 2025

Discovered

Apr 9, 2025

Filed

vs. sector median

1 wks faster

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Filing propagation · 2 filings

View merged incident ↗
HHS OCRApr 9 · first
California State AGApr 9 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.