Blue Shield of California, the covered entity (CE), reported that its business associate (BA) experienced a ransomware attack that compromised the protected health information (PHI) of 1,519 individuals. The PHI involved included names, dates of birth, and Social Security numbers. The CE notified HHS, affected individuals, the media, and provided substitute notice on its website. To mitigate the incident and prevent reoccurrence of a similar incident, the CE provided complimentary credit monitoring services and implemented additional administrative and technical safeguards to better protect sensitive data. OCR provided the CE with technical assistance regarding the importance of training and retraining after a security incident.
2026-09-25 · sector: other to insurance · backfill source
2026-09-25 · attack: unknown to hacking · backfill source
2026-09-25 · data_types: [] to ["names","health"] · backfill source
2026-09-25 · records_basis: empty to hhs · backfill source
2026-09-25 · records: empty to 1519 · backfill source
2026-09-25 · summary: empty to Blue Shield of California, the covered entity (CE), reported that its business associate (BA) experienced a ransomware attack that compromised the protected health information (PHI) of 1,519 individuals. The PHI involved included names, dat · backfill source
