California Physicians' Services

Blue Shield of California disclosed a misconfiguration in Google Analytics that allowed protected health information (PHI) to be shared with Google Ads between April 2021 and January 2024. The issue was discovered on February 11, 2025. Affected data includes insurance plan details, medical claim service dates, provider names, and patient financial responsibility. No malicious actor was involved; the exposure resulted from a vendor configuration error. Blue Shield severed the connection and reviewed security protocols.

Blue Shield of California experienced a data breach due to an incorrect data merge in its Member Health Record portal feature. From June 27, 2024, to April 4, 2025, some members could potentially view another member's protected health information, including visit dates, medications, immunizations, allergies, lab results, and diagnoses. The issue was identified on April 4, 2025, and the feature was immediately suppressed. No evidence suggests the data was downloaded or misused. Affected individuals are offered one year of Experian IdentityWorks.