BLUE CROSS AND BLUE SHIELD ASSOCIATION

Blue Cross Blue Shield Association (BCBSA) disclosed a security incident involving its Federal Employee Program (FEP) mobile app. A vendor's programming change on September 28, 2019, inadvertently altered permission functionalities, allowing adult family members to view summary claims information of other policyholders between September 28 and October 22, 2019. BCBSA disabled the feature upon discovery on October 22, 2019. Exposed data included names, addresses, health insurance IDs, and summary medical/pharmacy claims. No SSNs, DOBs, or financial data were accessed. The incident was contained, and no misuse was reported.

Blue Cross Blue Shield reported a data breach to the Montana Attorney General. The breach was reported on 2019-12-12. The breach occurred from 9/28/2019 to 10/22/2019. 54 Montana residents were affected.

Affected (this filing): 54