A data breach at Blue Cross Blue Shield of Montana (BCBSMT) was caused by a cyber incident at its third-party vendor, Conduent, which provides back-office services. The breach, detected in January 2025, involved unauthorized access by a threat actor who exfiltrated files containing personal information of 462,000 BCBSMT members. Conduent delayed notifying federal regulators for four months and BCBSMT members for nearly 10 months, raising concerns over compliance with Montana’s breach notification laws. The stolen data included sensitive member information, though Conduent claimed no evidence of it being leaked on the dark web. BCBSMT’s own systems were not directly compromised, but the vendor’s breach exposed member data due to their business relationship. Montana regulators are investigating potential reporting delays, with fines up to $25,000 per violation possible. Conduent incurred $25 million in direct response costs, including cybersecurity forensics and notifications, while maintaining that operations were restored quickly without material disruption.

Montana Blue Cross-Blue Shield (BCBSMT) suffered a major data breach via a third-party vendor, Conduent, which exposed the private data of 462,000 customers—nearly one-third of Montana’s population. The breach, occurring between November 8, 2024, and March 5, 2025, involved the exfiltration of highly sensitive information, including names, addresses, birth dates, billing and medical data, phone numbers, and other confidential details. While BCBSMT’s own systems remained unaffected, the incident stemmed from Conduent’s cybersecurity lapse, which processed mailroom, payment, and back-office services for the insurer. The breach triggered a state-level investigation by Montana’s Commissioner of Securities and Insurance, citing ‘far-reaching and jaw-dropping consequences’ for residents. Authorities emphasized the violation of trust in safeguarding health and financial data, with potential legal repercussions, including fines up to $25,000 per violation if negligence is proven. As of the report, no customer notifications had been issued by Conduent, heightening concerns over delayed response and exposure risks. The incident underscores critical vulnerabilities in third-party vendor security and the large-scale impact on personal and financial privacy.

The California Office of the Attorney General disclosed a data breach affecting Blue Cross Blue Shield Association (BCBSA) in December 2019. The incident stemmed from a programming error in the fepblue mobile app, which inadvertently allowed certain adult members to access summary claims information of other users between September 28, 2019, and October 22, 2019. While the exact number of impacted individuals remains undisclosed, the breach did not expose sensitive data such as Social Security Numbers (SSNs) or financial details. The exposed information was limited to claims summaries, suggesting no direct financial harm or identity theft risk. BCBSA addressed the vulnerability by correcting the error and notifying affected parties, though the incident highlighted gaps in application security and access controls. The breach was classified as unintentional, with no evidence of malicious exploitation by external actors.