Breachesby GlyphBlueCross BlueShield of Tennessee
Disclosed Dec 26, 20251,670 affectedConfirmed
The business associate (BA), BlueCross BlueShield of Tennessee, Inc., reported that a subcontractor of its covered entity (CE) experienced a breach that affected approximately 37,402 individuals. The protected health information (PHI) involved names and other identifiers. The BA notified HHS, affected individuals, and the media. In its mitigation efforts, the BA provided the affected individuals with free credit monitoring. OCR provided technical assistance to the BA regarding the HIPAA Rules.
What is known
| People affected | 1,670 (as reported to HHS) |
|---|---|
| Disclosed | Dec 26, 2025 |
| Attack | Hacking |
| Data exposed | NamesHealth |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
Notices filed
Other breaches at BlueCross BlueShield of Tennessee
Insider breachInsider exposed names and health records. Reported to the HHS archive.2,688 affectedHealthcareUSJul 25, 2023Hacking breachHacking exposed names and health records. Reported to the HHS archive.1,340 affectedInsuranceUSDec 18, 2020Theft of 57 unencrypted hard drives exposes data of over 1 million membersLost or stolen device exposed names, Social Security numbers, dates of birth, insurance details and health records.Lost or stolen device1.0M affectedInsuranceUSNov 1, 2010
History of this record
First seen 2026-09-25 (HHS archive), confirmed by HHS OCR. Record counts are as reported. Not legal advice.