Lawsuit against Blue Cross-Blue Shield says company knew about massive data breach, didn’t report it

A class-action lawsuit has been filed against Blue Cross-Blue Shield of Montana, alleging the company was aware of a massive data breach impacting approximately 462,000 customers – nearly one-third of the state’s population – for months but did not promptly notify those affected. The breach, caused by a third-party vendor (Conduent), potentially compromised sensitive data including birth dates, Social Security numbers, and health information. The lawsuit accuses Blue Cross-Blue Shield of negligence, breach of contract, and violating consumer protection laws, claiming they failed to implement adequate security measures like encryption and timely data deletion.

Plaintiffs argue the delayed notification prevented customers from taking steps to protect themselves from identity theft and financial harm, citing the potential for stolen data to be sold on the dark web and used for fraudulent activities. The lawsuit highlights the significant costs associated with medical identity theft, including out-of-pocket expenses and potential loss of healthcare coverage.

Attorneys are seeking court-ordered protections, including enhanced security protocols, regular audits, and a 10-year monitoring period to ensure compliance. They also request damages, including compensatory and punitive damages, to cover the costs of credit monitoring and other remedies for affected customers.

(Source：Daily Montanan)