The California Department of Justice disclosed a data breach affecting Blue Shield of California on November 8, 2024. The incident stemmed from a data mismatch error, which inadvertently permitted family members on the same insurance plan to access protected health information (PHI) of other plan members. The exposed data included medical visit types and medication details, though no personally identifiable demographic information (e.g., names, addresses, or Social Security numbers) was compromised. The breach impacted an undisclosed number of individuals (UNKN), with no evidence of malicious external intrusion or data theft by third parties. The error was internal, likely tied to system misconfigurations or access controls, and did not involve ransomware, cyberattacks, or broader unauthorized dissemination beyond the affected family members. Blue Shield has not confirmed whether the exposed PHI was exploited for fraud or further misuse, but the incident highlights vulnerabilities in health data segmentation and privacy safeguards within shared insurance plans.

The California Office of the Attorney General reported that Medical Eye Services, Inc. experienced a data breach involving Blue Shield of California. The incidents occurred on May 28, 2023, and May 31, 2023. The breach was related to unauthorized access to information on a MOVEit server exploited by a vendor. The specific number of affected individuals remains unknown.

The Maine Office of the Attorney General reported that Blue Shield of California experienced a data breach between January 28, 2023 and January 31, 2023, due to an external system breach (hacking) involving its subcontractor Fortra. The breach potentially affected approximately 63,341 individuals, including 44 residents of Maine, exposing their personal information such as names, addresses, and birthdates. Blue Shield is offering one year of complimentary identity theft protection services.

Blue Shield of California Promise Health Plan experienced a data breach incident related to a sub-contractor that works with one of Blue Shield’s third-party vendors. The breach leaked: names, subscriber ID numbers, diagnoses, medications, addresses, dates of birth, sex, advance directives, family history, social history, allergies, vitals, immunizations, encounter data, assessment ID numbers, and assessment dates. Blue Shield investigated the incident and notified all the impacted individuals about the breach.

The California Department of Insurance reported a data breach involving Blue Shield of California on December 22, 2022. The breach occurred when an employee emailed a confidential spreadsheet containing broker Personally Identifiable Information (PII) to a personal email address on October 30, 2022, and again on June 17, 2022. The affected information included names, Social Security Numbers, addresses, phone numbers, and email addresses.

Blue Shield of California, a major healthcare provider, suffered a ransomware attack on April 28, 2022, via its third-party vendor, OneTouchPoint. The breach exposed protected health information (PHI), including names, subscriber ID numbers, and medical details of an undisclosed number of individuals. The incident was reported to the California Office of the Attorney General on July 12, 2022, indicating a delayed disclosure. While the full scope of the data compromise remains unclear, the attack targeted sensitive healthcare records, raising concerns over potential misuse of personal and medical data. The involvement of a subcontractor highlights vulnerabilities in third-party risk management, amplifying the risk of large-scale data exposure in the healthcare sector. No confirmation was provided on whether a ransom was paid or if the attackers exfiltrated the data for further exploitation.

A Blue Shield of California broker, Team Alvarez Insurance Services, suffered from a data security breach that exposed 2,858 Blue Shield members' data. The compromised information includes names and health insurance information, health plan member ID number, date of birth, email addresses, phone numbers, and physical addresses. No Blue Shield member's social security numbers or credit card information was affected. Blue Shield systems and emails were never affected or vulnerable to this attack. Blue Shield offered a free year of Experian credit monitoring and identity theft protection in letters to members who the incident might have impacted.

On August 25, 2021, Blue Cross of California fell victim to a ransomware attack that compromised the sensitive personal and financial information of its members. The breach exposed a wide range of data, including names, dates of birth, gender, email addresses, phone numbers, physical addresses, Medicare ID numbers, provider details, bank account numbers, and—where applicable—Social Security numbers. The incident was formally reported by the California Office of the Attorney General on October 26, 2021. The exposed data poses significant risks, such as identity theft, financial fraud, and unauthorized access to healthcare services. Given the scale and sensitivity of the leaked information, the attack directly undermines customer trust and could lead to long-term reputational damage, regulatory penalties, and potential legal liabilities for the organization.

The California Office of the Attorney General reported a data breach involving Blue Shield of California on April 9, 2025. The breach, which reportedly started on April 1, 2021, involved the potential exposure of members' protected health information due to a misconfiguration with Google Analytics and Google Ads. Specific details on the number of individuals affected are unknown, but the compromised data included insurance plan details and medical service information.

The California Office of the Attorney General reported a data breach involving California Physicians' Services d/b/a Blue Shield of California on December 13, 2021. The breach occurred on January 20, 2021, due to a ransomware attack affecting protected health information, including names, dates of birth, subscriber ID numbers, and health plan information of an unknown number of individuals.

The California Office of the Attorney General reported a data breach involving Blue Shield of California on November 6, 2020. The breach occurred between October 16 and October 20, 2020, due to an error in updating Medicare Advantage HMO provider directories, potentially exposing individuals' Tax Identification Numbers. The number of affected individuals is currently unknown.

Blue Shield of California suffered a data breach via a third-party vendor, Sharecare, between May 21, 2018, and June 26, 2018. The incident exposed sensitive personal information, including names, addresses, and medical record numbers of an unspecified number of individuals. The breach triggered an immediate response, with the company engaging a forensic investigation firm to assess the scope and notifying the FBI for further action. While the exact number of affected individuals remains undisclosed, the compromised data poses significant risks, particularly given the sensitivity of medical records. The breach underscores vulnerabilities in third-party vendor security and the potential for large-scale exposure of protected health information (PHI). No ransomware was reported in this incident, but the leak of personal and medical data aligns with severe privacy and regulatory concerns, including potential HIPAA violations.

On April 13, 2018, the California Office of the Attorney General reported that Blue Shield of California experienced a data breach on November 1, 2017. The breach involved the unauthorized sharing of Protected Health Information (PHI) including names, addresses, subscriber identification numbers, and telephone numbers with an insurance broker during the 2018 Medicare Annual Enrollment Period.

The California Office of the Attorney General disclosed a data breach affecting Blue Shield of California between September 15, 2015, and December 17, 2015. The incident stemmed from unauthorized access via misused login credentials, compromising sensitive personal information of affected individuals. Exposed data included names, addresses, dates of birth, and Social Security numbers—highly valuable details for identity theft and fraud. The breach highlighted vulnerabilities in credential management and access controls, raising concerns over the protection of customer data. While the exact number of impacted individuals was not specified in the report, the nature of the exposed information posed significant risks, including financial fraud, identity impersonation, and long-term reputational damage to the company. The incident underscored the critical need for robust cybersecurity measures, particularly in healthcare, where personal data is a prime target for cybercriminals.

The California Office of the Attorney General reported a data breach involving Blue Shield of California on June 5, 2015. The breach occurred between May 9, 2015, and May 18, 2015, resulting in the unauthorized disclosure of Protected Health Information (PHI) for an unknown number of individuals, including names, Social Security Numbers, and dates of birth.

On May 16, 2014, the California Department of Managed Health Care disclosed a data breach affecting Blue Shield of California, stemming from an administrative error in publicly filed documents between February and April 2013. The incident involved the inadvertent exposure of provider Social Security numbers (SSNs), though the exact number of affected individuals remained undisclosed. The breach was attributed to a procedural failure in redacting sensitive information before submission, leading to the unintended disclosure of personally identifiable information (PII). While no evidence suggested malicious exploitation of the exposed data, the incident posed risks of identity theft, financial fraud, or reputational harm to the impacted healthcare providers. The breach was reported over a year after its occurrence, raising concerns about delayed detection and response protocols within the organization. No ransomware or targeted cyber attack was involved, classifying it as a non-malicious but high-impact data exposure tied to internal process deficiencies.

The California Office of the Attorney General reported a data breach involving Blue Shield of California on July 3, 2014. The breach occurred during the submission of provider rosters on February 28, 2013, March 31, 2013, and April 30, 2013, inadvertently disclosing provider Social Security numbers (SSNs), names, addresses, and business details. The number of individuals affected is currently unknown.