launched an investigation<\/a> into the breach from a third-party business that works with BCBSMT. \u00a0<\/p>\nWhy It Matters\u00a0<\/p>\n
The lawsuit claims that the BCBSMT was negligent by failing to protect members\u2019 sensitive personal and medical data, exposing them to identity theft or fraud. Furthermore, the plaintiffs claim that BCBSMT has yet to notify members about the breach and potential impacts of the compromised data. \u00a0<\/p>\n
The plaintiffs in this case are accusing the insurer of negligence, invasion of privacy, breach of implied contract, violation of the Montana Consumer Protection Act and unjust enrichment, according to the case filing. <\/p>\n
What To Know\u00a0<\/p>\n
Attorneys from Western Justice Associates filed a complaint in the U.S. District Court of Montana on behalf of their clients Thursday. The case is against Health Care Services Corporation, which is the licensee of Blue Cross Blue Shield in five states, including Montana. \u00a0<\/p>\n
From November 2024 to March 2025, third-party business services company Conduent suffered a data breach that compromised personal and health data from about 462,000 Montanans. <\/p>\n
This information likely includes names, Social Security numbers, dates of birth, phone numbers, billing and medical data, treatment and diagnosis codes, provider names and claims amounts that could be used by \u201cmalicious actors\u201d to commit fraud or identity theft, according to the filing. \u00a0<\/p>\n
The filing said BCBSMT completed an investigation into the breach to review affected data on September 23, 2025, and notified the Montana State Auditor\u2019s Office in early October. \u00a0<\/p>\n
Despite being aware of the breach for many months, the plaintiffs claim that BCBSMT has yet to notify its members about it. \u00a0<\/p>\n
The filing said the ramifications of BCBSMT\u2019s failure to secure members\u2019 personal information are \u201clong-lasting and severe,\u201d citing reports from the Federal Trade Commission and CreditCards.com.\u00a0<\/p>\n
\u201c[BCBSMT] was aware, or reasonably should have been aware, that a member\u2019s sensitive personal information is of significant value to those who would use it for wrongful purposes,\u201d the filing states. “Once sensitive personal information is stolen, fraudulent use of that information and damage to the affected members may continue for years.\u201d\u00a0<\/p>\n
In a statement earlier this week, Montana State Auditor Brown said the breach was not just a technical lapse, but a \u201cdeeply disturbing incident with far-reaching and jaw-dropping consequences for our citizens.\u201d\u00a0 He also said BCBSMT did not notify customers in a timely manner and is taking action to ensure accountability and transparency for Montanans. \u00a0<\/p>\n
BCBSMT confirmed to Newsweek that some of its member data was affected by the cyberattack on the third-party company but claims that BCBS systems were not affected. \u00a0<\/p>\n
The filing claims that plaintiffs either have suffered or are at increased risk of suffering damages as a result of the data breach. This includes the compromise, publication, theft and\/or unauthorized use of their personal data, out-of-pocket costs associated with prevention, detection, recovery and remediation from identity theft or fraud, lost opportunity costs and lost wages and time. Plaintiffs also claim they are at risk of future leaks \u201cso long as [BCBSMT]\u00a0fails to undertake appropriate measures to protect\u201d the personal identifying and protected health information in their possession.\u00a0<\/p>\n
According to the filing, at least one plaintiff has noticed \u201csuspicious activity\u201d regarding her Social Security number this year.\u00a0<\/p>\n
Because BCBSMT \u201chas demonstrated an inability to prevent a breach,\u201d the plaintiffs and class action members said they have an \u201cundeniable interest\u201d in ensuring that their personal identifying information and protected health information is secure, remains secure, and is not subject to further theft. \u00a0<\/p>\n
When asked for comment on the latest court filing, Blue Cross Blue Shield told Newsweek it does not comment on pending litigation.<\/p>\n
What Happens Next\u00a0<\/p>\n
According to the filing, the court will determine whether BCBSMT had a duty to implement reasonable cybersecurity measures to protect members\u2019 sensitive personal information and to \u201cpromptly\u201d alert them if that information was compromised. \u00a0<\/p>\n
Plaintiffs are also asking the court to decide whether the insurer violated its duty by failing to take \u201creasonable precautions\u201d to protect members\u2019 sensitive personal information, whether it acted negligently by failing to implement reasonable data security practices and procedures, and whether these failures violate Montana\u2019s Consumer Protection Act. \u00a0<\/p>\n
UPDATE 10\/24\/2025 at 1:08 p.m.: This story has been updated with comment from Blue Cross Blue Shield. <\/p>\n
Have an announcement or news to share? Contact the Newsweek Health Care team at\u00a0health.care@newsweek.com<\/a>.\u00a0\u00a0\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"A class action lawsuit has been filed against Blue Cross Blue Shield of Montana (BCBSMT) over the insurer\u2019s…\n","protected":false},"author":3,"featured_media":330797,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[35],"tags":[164175,104174,210,1141,1142,379,13668,67,132,68],"class_list":{"0":"post-330796","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-health-care","8":"tag-blue-cross-blue-shield","9":"tag-class-action-lawsuit","10":"tag-health","11":"tag-health-care","12":"tag-healthcare","13":"tag-lawsuit","14":"tag-montana","15":"tag-united-states","16":"tag-unitedstates","17":"tag-us"},"share_on_mastodon":{"url":"https:\/\/pubeurope.com\/@us\/115433023884281613","error":""},"_links":{"self":[{"href":"https:\/\/www.europesays.com\/us\/wp-json\/wp\/v2\/posts\/330796","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/us\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/us\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/us\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/us\/wp-json\/wp\/v2\/comments?post=330796"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/us\/wp-json\/wp\/v2\/posts\/330796\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/us\/wp-json\/wp\/v2\/media\/330797"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/us\/wp-json\/wp\/v2\/media?parent=330796"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/us\/wp-json\/wp\/v2\/categories?post=330796"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/us\/wp-json\/wp\/v2\/tags?post=330796"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}