Blue Cross Blue Shield of Michigan bcbsm.com Blue Cross Blue Shield of Michigan data breach 2015: what happened and what to do
Blue Cross Blue Shield of Michigan told HHS in 2015 that the health information of 3,903 patients was stolen for identity fraud. It included names, dates of birth, contract and group numbers and Social Security numbers.
View all 13,177 breaches- Breach date
- 17 Mar 2015
- Affected
- 3,903
- Data exposed
- Names, Ages, Genders, Dates of birth, Social security numbers, Health insurance information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Blue Cross Blue Shield of Michigan (BCBSM) reported a breach to the U.S. Department of Health and Human Services (HHS) in 2015. This page covers that report. BCBSM has had other incidents over the years, and they are separate.
What HHS says happened
HHS's Office for Civil Rights (OCR) opened an investigation after BCBSM reported that the protected health information of 3,903 patients had been stolen for the purposes of identity fraud. The case is listed as theft. BCBSM notified HHS, the media and the people affected.
What was exposed
According to HHS, the information included names, ages, genders, dates of birth, contract numbers, group names and numbers, and Social Security numbers. A Social Security number plus a date of birth is enough for someone to try to open credit in your name. Contract and group numbers can be used for medical identity theft, where someone gets care or files claims using your coverage.
What BCBSM changed
OCR says BCBSM improved its safeguards afterward: it masked Social Security numbers, removed members' dates of birth, limited search results to 25 records, and installed printers that require employees to scan their coded badges. OCR obtained assurances that these corrective actions were in place.
What this means for you
If you received a notice from BCBSM about this incident, act on the SSN steps below. The Social Security number can't be changed in practice, so a credit freeze is the lasting protection.
Sources checked: ocrportal.hhs.gov, consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A credit freeze stops lenders from seeing your credit report, which blocks most new accounts in your name. The FTC says it's free and you place it separately at Equifax, Experian and TransUnion. You lift it temporarily when you apply for credit yourself.
- 2
Look at your credit reports and statements
Order your free credit reports and look for accounts or inquiries you don't recognize. Read your bank, card and insurance statements for charges or claims you didn't make. The FTC's IdentityTheft.gov/databreach page walks through the steps for the type of data that leaked.
- 3
Take the free credit monitoring if it's offered
If the organization offers free credit monitoring or identity theft protection, the FTC recommends taking it. Use the enrollment instructions in the letter you received, not a link in an unexpected message.
- 4
Expect scams that mention the incident
Anyone who knows you were affected can write or call as if they're helping. Don't give details to someone who contacted you first. Contact the organization using a number from its own website or your card or insurance ID.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches your email address or phone number appears in. Serus monitors breach databases and the dark web and alerts you when something new turns up. It can't remove data that has already leaked, so the steps above are still the fix.
Official filings
- U.S. Department of Health and Human Services , filed 17 Mar 2015 : 3,903 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by this BCBSM breach?
HHS lists 3,903 patients. If BCBSM sent you a notice about it, you were one of them.
What was exposed?
Names, ages, genders, dates of birth, contract numbers, group names and numbers, and Social Security numbers, according to HHS.
How was the data taken?
HHS lists the cause as theft and says the data was stolen for identity fraud. It doesn't give more detail.
Should I freeze my credit?
The FTC says a free credit freeze makes it harder to open new accounts in your name, and it's a sensible step when your Social Security number was exposed.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
