Blue Shield of California
Disclosed Feb 28, 20251 year ago4,700,000 affectedConfirmed
Google Analytics misconfiguration shared 4.7M members' health data
Blue Shield of California said Google Analytics on its websites was misconfigured from April 2021 to January 2024, sending member data such as insurance plan details, claim dates, providers and search terms to Google Ads; it notified 4.7 million people.
What is known
| People affected | 4,700,000 (as reported by the organization) |
|---|---|
| Disclosed | Feb 28, 2025 |
| Discovered | Feb 2025 |
| Happened | Mar 25, 2025 |
| Attack | Exposed data |
| Data exposed | Names, Health, Insurance, Other |
| Sector | Insurance · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Blue Shield of Californiaoag.ca.gov · Official notice | Official notice |
| HHS OCR breach report: Blue Shield of California (Business Associate, CA)ocrportal.hhs.gov · Official notice | Official notice |
| Blue Shield of California shared the private health data of millions with Google for yearstechcrunch.com · News | News |
| Blue Shield of California leaked health data of 4.7 million members to Googlebleepingcomputer.com · News | News |
| April 2025 Healthcare Data Breach Reporthipaajournal.com · News | News |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Feb 28, 2025 | 624 |
| California AGresidents of CA | Mar 28, 2025 | |
| California AGresidents of CA | Apr 9, 2025 | |
| HHS archivetotal | Apr 9, 2025 | 4,700,000 |
| Researchtotal | Apr 23, 2025 | 4,700,000 |
| California AGresidents of CA | Jun 6, 2025 | |
| HHS OCRtotal | Jun 6, 2025 | 1,543 |
| California AGresidents of CA | Jun 23, 2025 | |
| HHS OCRtotal | Jun 23, 2025 | 673 |
| California AGresidents of CA | Jul 21, 2025 | |
| HHS archivetotal | Jul 21, 2025 | 783 |
| HHS archivetotal | Sep 29, 2025 | 607 |
| HHS archivetotal | Sep 29, 2025 | 93,921 |
Other breaches at Blue Shield of California
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Disclosed Jul 12, 2022Jul 12, 20224 years agoHacking | Jul 12, 20224 years ago | Hacking | Insurance | Confirmed | 1,506 |
| Disclosed Oct 27, 2021Oct 27, 20214 years agoHacking | Oct 27, 20214 years ago | Hacking | Insurance | Confirmed | 1,519 |
| Disclosed Jan 14, 2016Jan 14, 201610 years agoInsider | Jan 14, 201610 years ago | Insider | Insurance | Confirmed | 21K |
| Disclosed Feb 18, 2014Feb 18, 201412 years ago | Feb 18, 201412 years ago | Not stated | Other | Confirmed | Unknown |
History of this record
- 2026-09-25 · disclosed: 2025-03-28 to 2025-02-28 · backfill source
- 2026-09-25 · sector: health to insurance · seed source
- 2026-09-25 · attack: insider to misconfiguration · seed source
- 2026-09-25 · data_types: ["names","health"] to ["names","health","insurance","other"] · seed source
- 2026-09-25 · records_basis: hhs to organization · seed source
- 2026-09-25 · records: 1543 to 4700000 · seed source
- 2026-09-25 · discovered: empty to 2025-02 · seed source
- 2026-09-25 · summary: empty to Blue Shield of California said Google Analytics on its websites was misconfigured from April 2021 to January 2024, sending member data such as insurance plan details, claim dates, providers and search terms to Google Ads; it notified 4.7 mi · seed source
- 2026-09-25 · title: empty to Google Analytics misconfiguration shared 4.7M members' health data · seed source
- 2026-09-25 · records: 673 to 1543 · backfill source
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to insider · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 673 · backfill source
- 2026-09-25 · disclosed: 2025-04-09 to 2025-03-28 · backfill source
- 2026-09-25 · disclosed: 2025-06-06 to 2025-04-09 · backfill source
- 2026-09-25 · disclosed: 2025-06-23 to 2025-06-06 · backfill source
- 2026-09-25 · disclosed: 2025-07-21 to 2025-06-23 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.