BlueCross BlueShield of Tennessee
Disclosed Nov 1, 201015 years ago1,023,209 affectedSettled
Theft of 57 unencrypted hard drives exposes data of over 1 million members
Fifty-seven unencrypted hard drives holding recorded customer calls were stolen from a leased BCBST facility in Tennessee, exposing names, Social Security numbers, birth dates and health plan IDs of over 1 million people. It was the first HHS enforcement action under the HITECH breach rule.
What is known
| People affected | 1,023,209 (as reported by the organization) |
|---|---|
| Disclosed | Nov 1, 2010 |
| Attack | Lost or stolen device |
| Data exposed | Names, Social Security numbers, Dates of birth, Insurance, Health |
| Sector | Insurance · US |
| Status | Settled |
| Lawsuit or fine | $1.5M HHS OCR HIPAA settlement (2012) (about $1.5M) |
Sources
| Source | |
|---|---|
| HHS Office for Civil Rights breach portal (archive): Breaches Affecting 500 or More Individualsocrportal.hhs.gov · Regulator | Regulator |
| HHS settles HIPAA case with BCBST for $1.5 millionweb.archive.org · Regulator | Regulator |
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | Nov 1, 2010 | 1,023,209 |
| HHS archivetotal | Nov 1, 2010 | 1,023,209 |
Other breaches at BlueCross BlueShield of Tennessee
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Disclosed Dec 26, 2025Dec 26, 20259 months agoHacking | Dec 26, 20259 months ago | Hacking | Healthcare | Confirmed | 1,670 |
| Disclosed Jul 25, 2023Jul 25, 20233 years agoInsider | Jul 25, 20233 years ago | Insider | Healthcare | Confirmed | 2,688 |
| Disclosed Dec 18, 2020Dec 18, 20205 years agoHacking | Dec 18, 20205 years ago | Hacking | Insurance | Confirmed | 1,340 |
History of this record
- 2026-09-25 · added · seed source
First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.