Notice of Data Breach

Blue Shield of California has begun notifying certain members of a potential data breach that may have included elements of their protected health information. Due to the complexity and scope of the disclosures, Blue Shield is unable to confirm whether any particular member’s specific information was affected. Out of an abundance of caution, Blue Shield is providing notice to all members who may have accessed their member information on the potentially impacted Blue Shield websites during the relevant time frame. Blue Shield takes this matter very seriously and has already initiated measures to safeguard against similar future disclosures.

What happened

Like other health plans, Blue Shield historically used the third-party vendor service, Google Analytics, to internally track website usage of members who entered certain Blue Shield sites. We were doing this to improve the services we provide to our members.

On February 11, 2025, Blue Shield discovered that, between April 2021 and January 2024, Google Analytics was configured in a way that allowed certain member data to be shared with Google’s advertising product, Google Ads, that likely included protected health information. Google may have used this data to conduct focused ad campaigns back to those individual members. We want to reassure our members that no bad actor was involved, and, to our knowledge, Google has not used the information for any purpose other than these ads or shared the protected information with anyone.

Blue Shield severed the connection between Google Analytics and Google Ads on its websites in January 2024 and has since asked Google to cease using and return any member information that it may have retained from the relevant time period. We have no reason to believe that any member data has been shared from Blue Shield’s websites with Google after the connection was severed. Upon discovering the issue, Blue Shield immediately initiated a review of its websites and security protocols to ensure that no other analytics tracking software is impermissibly sharing members’ protected health information.

What information was involved

The information that may have been impacted includes the following:

Insurance plan name, type and group number; city; zip code; gender; family size; Blue Shield assigned identifiers for members’ online accounts; medical claim service date and service provider, patient name, and patient financial responsibility; and “Find a Doctor” search criteria and results (location, plan name and type, provider name and type).

There was no disclosure of other types of personal information, such as Social Security numbers, driver’s license numbers, or banking or credit card information.

What we are doing

We understand receiving a notice such as this can create concern, and we regret that member personal information may have been shared without authorization. Blue Shield takes the security of member information very seriously, and we are committed to maintaining their privacy.

Steps members can take to protect their information

Review your account statements and notify law enforcement of suspicious activity

As a precautionary measure, we recommend that members remain vigilant by closely reviewing their account statements and credit reports. If they detect any suspicious activity on an account, they should promptly notify the financial institution or company with which the account is maintained.

Additionally, members should report any fraudulent activity or suspected incidence of identity theft to proper law enforcement authorities, including local law enforcement to file a police report, the Attorney General, or the FTC. To file a complaint with the FTC, go to www.ftc.gov/idtheft or call 1-877-ID-THEFT (877-438-4338). Complaints filed with the FTC will be added to the FTC’s Identity Theft Data Clearinghouse, which is a database made available to law enforcement agencies. A copy of Take Charge: Fighting Back Against Identity Theft, a comprehensive guide from the FTC to help you guard against and deal with identity theft, can be found on the following website: https://www.ojp.gov/ncjrs/virtual-library/abstracts/take-charge-fighting-back-against-identity-theft

Copy of credit report

Members may obtain a free copy of their credit report from each of the three major credit reporting agencies once every 12 months by visiting http://www.annualcreditreport.com or calling 877-322-8228. Or they can elect to purchase a copy of their credit report by contacting one of the three national credit reporting agencies. Contact information for the three national credit reporting agencies is provided below.

Fraud alert

Members may also consider placing a fraud alert on their credit report. An initial fraud alert is free and will remain on a credit file for at least 90 days. The alert informs creditors of possible fraudulent activity within the report and requests that the creditor contact the requesting party prior to establishing any accounts in the requesting party’s name. To place a fraud alert on a credit report, contact any of the three credit reporting agencies using the information below:

Equifax

1-800-525-6285

www.equifax.com

P.O. Box 740241

Atlanta, GA 30374     

Experian

(888) 397-3742

www.experian.com

P.O. Box 9532

Allen, TX 75013        

TransUnion

(800) 680-7289

www.transunion.com

P.O. Box 2000

Chester, PA 19022