Connecticut Attorney General's Office

Press Release

Attorney General Investigating Blue Cross Blue Shield Data Breach Affecting 18,000 CT Health Care Professionals, Seeks Additional Protection For Victims

November 9, 2009

Attorney General Richard Blumenthal is investigating Blue Cross Blue Shield's loss of confidential information, including tax identification and some Social Security numbers, for all 18,817 of its individual Connecticut health care providers, as well as seeking additional identity theft protection for affected doctors, therapists and other professionals.

Blumenthal said that the company and its affiliates may have violated state law by losing the information and failing to notify providers in a timely manner. The companies are offering professionals one year of identity theft protection, but Blumenthal called these measures "inadequate and unacceptable, and said, "I will fight for at least two years."

Blumenthal said the information was lost when a laptop was stolen on August 25. The laptop held information on the companies' providers nationwide, including names, addresses, tax identification and provider numbers and some Social Security numbers.

Although the computer was stolen in late August, Blue Cross Blue Shield and its related companies Anthem and Empire failed to inform health care providers until late last month.

"As appalling as the data loss, equally alarming and potentially illegal is the delay in disclosing it," Blumenthal said. "We are vigorously investigating this appalling data loss, needlessly exposing more than 18,000 Connecticut doctors and professionals to devastating identity theft.

"Failing to promptly notify providers of the breach is inexcusable -- and a possible violation of state law. Waiting two months left providers severely at risk -- needlessly and irresponsibly exposing them to financial mayhem.

"My office demands a full accounting from Blue Cross Blue Shield -- healthcare providers affected, details of the loss, protections for professionals, policies and procedures for data loss and other information. State laws mandate that companies fully secure sensitive personal information and quickly disclose breaches -- laws the companies may have broken.

"Anthem's one year of identity theft protection is inadequate and unacceptable. Connecticut doctors and health care professionals expect and deserve a stronger shield against identity loss. I will fight for greater safeguards, including longer identity theft protection, as I have done in other data breaches.

"For identity thieves, private personal data is as good as gold -- and should be secured with equal vigor and vigilance. Companies must closely protect Social Security numbers and other sensitive data."

In addition to protections provided by the companies, Blumenthal said that health care providers can protect themselves by asking the three major credit rating agencies to place a free "Fraud Alert" on their credit reports. The companies are: Equifax - 1-800-525-6285; Experian - 1-888-397-3742; TransUnion - 1-800-680-7289.

Health care providers can also have the major credit rating agencies "freeze" their credit, meaning no new credit can be taken out in their names without their express authorization. A credit freeze request must be made in writing by certified mail to one of the three major credit rating agencies, Equifax, Experian and Transunion.

Credit bureaus charge $10 to freeze and $12 to temporarily un-freeze credit. Blumenthal will seek reimbursement to health care providers for credit freezes and un-freezes.