Breachesby GlyphBlue Shield of California
Disclosed Feb 28, 20254,700,000 affectedConfirmed
Google Analytics misconfiguration shared 4.7M members' health data
Blue Shield of California said Google Analytics on its websites was misconfigured from April 2021 to January 2024, sending member data such as insurance plan details, claim dates, providers and search terms to Google Ads; it notified 4.7 million people.
What is known
| People affected | 4,700,000 (as reported by the organization) |
|---|---|
| Disclosed | Feb 28, 2025 |
| Discovered | Feb 2025 |
| Happened | Mar 25, 2025 |
| Attack | Exposed data |
| Data exposed | NamesHealthInsuranceOther |
| Sector | Insurance · US |
| Status | Confirmed |
Sources
California Attorney General breach notice: Blue Shield of CaliforniaHHS OCR breach report: Blue Shield of California (Business Associate, CA)Blue Shield of California shared the private health data of millions with Google for yearsBlue Shield of California leaked health data of 4.7 million members to GoogleApril 2025 Healthcare Data Breach Report
Notices filed
HHS archive624 peopleCalifornia AGCount not statedCalifornia AGCount not statedHHS archive4,700,000 peopleResearch4,700,000 peopleCalifornia AGCount not statedHHS OCR1,543 peopleCalifornia AGCount not statedHHS OCR673 peopleCalifornia AGCount not statedHHS archive783 peopleHHS archive607 peopleHHS archive93,921 people
Other breaches at Blue Shield of California
Hacking breachHacking exposed names and health records. Reported to the California AG.1,506 affectedInsuranceUSJul 12, 2022Hacking breachHacking exposed names and health records. Reported to the California AG.1,519 affectedInsuranceUSOct 27, 2021Insider breachInsider exposed names and health records. Reported to the California AG.21K affectedInsuranceUSJan 14, 2016Breach, details not statedBreach notice filed with the California AG, details not stated.USFeb 18, 2014
History of this record
2025-03-28 to 2025-02-28by backfillSource
health to insuranceby seedSource
insider to misconfigurationby seedSource
["names","health"] to ["names","health","insurance","other"]by seedSource
hhs to organizationby seedSource
1543 to 4700000by seedSource
empty to 2025-02by seedSource
empty to Blue Shield of California said Google Analytics on its websites was misconfigured from April 2021 to January 2024, sending member data such as insurance plan details, claim dates, providers and search terms to Google Ads; it notified 4.7 miby seedSource
empty to Google Analytics misconfiguration shared 4.7M members' health databy seedSource
673 to 1543by backfillSource
other to healthby backfillSource
unknown to insiderby backfillSource
[] to ["names","health"]by backfillSource
empty to hhsby backfillSource
empty to 673by backfillSource
2025-04-09 to 2025-03-28by backfillSource
2025-06-06 to 2025-04-09by backfillSource
2025-06-23 to 2025-06-06by backfillSource
2025-07-21 to 2025-06-23by backfillSource
First recordedby backfillSource
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.