Blue Shield of California blueshieldca.com Blue Shield of California data breach: what happened and what to do
Blue Shield of California said member data went to Google's analytics and advertising tools between April 2021 and January 2024 because of a misconfigured setup. About 4.7 million people were notified. It reported no Social Security numbers.
View all 13,115 breaches- Breach date
- Apr 2021
- Made public
- 9 Apr 2025
- Affected
- 4,700,000
- Data exposed
- Names, Health insurance information, Physical addresses
- Last updated
What happened
In April 2025 Blue Shield of California told members that a misconfigured Google Analytics setup on several of its websites had been sending member information to Google's analytics and advertising platforms. The exposure ran from April 2021 to January 2024. This was not an attacker breaking in: the company's own website tracking shared the data.
Blue Shield notified about 4.7 million people, out of a membership of roughly 6 million. The listing appeared on the HHS Office for Civil Rights breach portal on April 22, 2025.
What was exposed
According to the notice, the data included names, insurance plan details (plan name, type and group number), city and ZIP code, gender, family size, Blue Shield member ID numbers, claim service dates, provider information, and details typed into the "Find a Doctor" search. Blue Shield said it did not involve Social Security numbers, driver's license numbers or financial data.
Blue Shield said Google may have used the data to show targeted ads to individual members. It reported no evidence that malicious third parties accessed it.
What it means for you
Health plan details tied to your name are useful to a scammer posing as an insurer or doctor's office, so expect calls and texts about "your plan" or "a claim". Member ID numbers can also be used in medical identity fraud, which is why checking your explanation of benefits matters here.
The company's response
Blue Shield disconnected the analytics tool from the advertising platform and began a wider review of its digital security practices.
What to do if you were in it
- 1
Check your explanations of benefits
Look for claims or providers you don't recognize and report them to Blue Shield. Medical identity fraud shows up here first.
- 2
Treat calls about your plan as suspect
Scammers who know your plan name or member ID sound convincing. Hang up and call the number on the back of your member card.
- 3
Don't share your member ID
Give it only to providers you chose to see, and never to someone who contacted you first.
- 4
Check whether your email or phone is in this and other breaches
A free Serus scan shows where your email address and phone number have appeared in known breaches and tells you what to do next.
Frequently asked
Was I affected?
Blue Shield notified about 4.7 million people. If you were a member during the exposure window of April 2021 to January 2024, look for a notice letter or contact Blue Shield member services.
Were Social Security numbers exposed?
No. Blue Shield said the incident did not include Social Security numbers, driver's license numbers or financial data.
Was the data stolen by hackers?
Blue Shield described it as data shared with Google's analytics and advertising platforms through a misconfiguration, and said it had no evidence that malicious third parties accessed it.
Should I change my password?
The notice didn't say passwords were involved, so there is no need to change them because of this incident.
Sources
- bleepingcomputer.com/news/security/blue-shield-of-california-leaked-health-data-of-47-million-members-to-google/
- therecord.media/healthcare-data-breaches-blue-shield-california
- malwarebytes.com/blog/news/2025/04/4-7-million-customers-data-accidentally-leaked-to-google-by-blue-shield-of-california
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- oag.ca.gov/privacy/databreach/list
Something wrong or out of date? Tell us and we'll re-check it.
