Excellus BlueCross BlueShield
Disclosed Sep 9, 201511 years ago9,358,891 affectedSettled
Attack dating to 2013 exposes data of up to 10 million Excellus customers
Excellus found on August 5, 2015 that attackers had been in its systems since December 2013. It reported 9.36 million affected individuals to HHS and later paid $5.1 million to settle HIPAA violations.
What is known
| People affected | 9,358,891 (as reported by the organization) |
|---|---|
| Disclosed | Sep 9, 2015 |
| Discovered | Aug 5, 2015 |
| Attack | Hacking |
| Data exposed | Names, Dates of birth, Social Security numbers, Addresses, Financial, Insurance, Health |
| Sector | Insurance · US |
| Status | Settled |
| Lawsuit or fine | $5.1M HHS OCR HIPAA settlement (2021) (about $5.1M) |
Sources
| Source | |
|---|---|
| HHS Office for Civil Rights breach portal (archive): Breaches Affecting 500 or More Individualsocrportal.hhs.gov · Regulator | Regulator |
| Health Insurer Pays $5.1 Million to Settle Data Breach Affecting Over 9.3 Million Peopleweb.archive.org · Regulator | Regulator |
| Cyber breach hits 10 million Excellus customersusatoday.com · News | News |
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | Sep 9, 2015 | 9,358,891 |
History of this record
- 2026-09-25 · added · seed source
First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.