CALIFORNIA PHYSICIANS' SERVICE

Medical Eye Services (vendor) exploited MOVEit vulnerability on Aug 23, 2023, affecting Blue Shield of California (victim). Data exfiltrated May 28-31, 2023. Incident reported to FBI. Notifications mailed Nov 17, 2023 to NH residents. Data included names, SSNs, DOBs. Remediation: system rebuild, credit monitoring offered.

California Physicians’ Service d/b/a Blue Shield of California reported to HHS on 2023-11-17 a Hacking/IT Incident affecting 636,849 individuals. Breached information located on Network Server. A business associate experienced a cyber-attack compromising PHI including names, SSNs, diagnoses, addresses, birthdates, and claims. The CE provided credit monitoring and implemented additional safeguards.

Blue Shield of California notified members that a third-party vendor, Sharecare Health Data Services, experienced unauthorized access to servers containing member personal information between May 21, 2018, and June 26, 2018. Data was exfiltrated to locations outside the US. Affected data included names, addresses, dates of birth, subscriber numbers (SSNs for some), and medical record numbers. Blue Shield learned of the incident on December 31, 2018, and mailed notices on February 15, 2019. Mandiant was engaged for forensic investigation, and the FBI was notified.