Tuesday, January 29, 2008

Security Breach at Horizon Blue Cross Blue Shield of NJ

In a letter dated January 28, 2008, Horizon Blue Cross Blue Shield of New Jersey has informed New Jersey businesses and their employees of a data security breach that occurred when a Horizon employee's laptop computer was stolen.

The laptop contained the names, addresses and social security numbers of New Jersey employees and their dependents. Between 200,000 and 300,000 identities were on the stolen computer.

A spokesperson for Horizon said that the theft occurred at the home of their employee on January 5, 2008. The compromised data was destroyed on January 23, 2008 when the stolen computer accessed the Internet, according to the spokesperson.

When asked how many Horizon Blue Cross employees take customers' personal data home with them, the spokesperson said that such data is not supposed to be on laptop hard drives, but the employee involved in this incident was authorized to have the data.

Requests to speak to Horizon Privacy Official who signed the letter were declined.

Horizon is offering their compromised customers free credit report monitoring for one year through ConsumerInfo.com. The spokesperson said that they would not reimburse customers who already subscribe to credit report monitoring through another service.

8 comments:

Anonymous said...

You Curmudgeonly Thing

I believe in Malcolm
Where you from
You curmudgeonly thing
(Curmudgeonly thing you)
I believe in Malcolm
Since you came along
You curmudgeonly thing

How did we know that you'd be the one
Been a long time here since Larrison
Doing all the things that makes the APP sing
Keep doing what you're doing you curmudgeonly thing

How didya' know we needed you so badly
How didya' know we gave the county gladly
Yesterday I was one of the unrepresented people
Now you're sittin' next to me
Representin' me

I believe in Malcolm
Where you from
You curmudgeonly thing
(Curmudgeonly thing you)
I believe in Malcolm
Since you came along
You curmudgeonly thing

Only yesterday we were on our own
Just another day later control was blown
You curmudgeonly thing come into our life
You make the Dems feels alright
How did Bill know that you'd be the one
Been a long time coming, you're like Harry's son
Doing all the things that makes Adam's heart sing
Keep doing what you're doing you curmudgeonly thing

How didya' know we needed you so badly
How didya' know we'd give our fees gladly
Yesterday I was in need of legal counsel
Now you're sittin' next to me
Givin' it to me

Oooh!!!

I believe in Malcolm
Where you from
You curmudgeonly thing
(Curmudgeonly thing you)
I believe in Malcolm
Since you came along
You curmudgeonly thing

Advise me counsel
You curmudgeonly thing
You curmudgeonly thing

Advise me counsel
You curmudgeonly thing
You curmudgeonly thing

Advise me counsel
You curmudgeonly thing
You curmudgeonly thing

Advise me counsel
You curmudgeonly thing
You curmudgeonly thing

Advise me counsel
You curmudgeonly thing
You curmudgeonly thing
(To fade...)

Anonymous said...

Can I sue Horizon Blue if I fall a victim to the identity theft because of this in the future?

Art Gallagher said...

Anonymous 8:47 am said...
Can I sue Horizon Blue if I fall a victim to the identity theft because of this in the future?

You should consult an attorney rather than asking for legal advice on a blog that not written by an attorney.

Anonymous said...

By state law ... Horizon will most likely be required to provide access recovery services for victims ... such as education, assistance, and credit monitoring.

Anonymous said...

Great. My company has just signed up with Horizon BC/BS. Oddly enough, the rep I was dealing with was no longer working there one day. This was last week. She was dealing with me as if she would be dealing with me the next day. The following day I tried to e-mail her and the mail was undeliverable.

Hmmmmmm, I wonder if......

Anonymous said...

lugar96 - You have my condolences.

Horizon will most likely be required to provide access recovery services for victims ... such as education, assistance, and credit monitoring.

I do not know what good those things will do for the victims of Horizon's carelessness. Why should people trust services recommended by a company that did not even bother to properly safeguard their information in the first place? Not to mention that Horizon seems unable to tell policy holders exactly *what* information was leaked. Not exactly confidence inspiring.

Rather than trying to gloss over an appalling lack of security and judgment, people should be very concerned and outraged that Horizon allowed this to happen at all. People should write to their local papers, file complaints, contact their local politicians and demand that Horizon be held accountable for this appalling mishandling of information entrusted to them by policy holders.

Horizon should also be required to provide policy holders with full and accurate accounting about exactly what happened.

- Was medical information on the laptop?

- Can they prove the information wasn't already accessed or copied between Jan 5th and Jan 23rd?

- Why was this highly sensitive information EVER allowed to leave a secured environment?

- Will Horizon continue to allow employees to remove highly confidential information from secured environments on laptops that can be easily stolen from a car, etc.?

I would also like to know if Horizon will be held legally and monetarily responsible for this as their unfortunate policy holders will if someone uses their information? If this is how seriously Horizon takes their policy holders confidential information and privacy rights they should be barred from asking for things like social security number in the future.

Anonymous said...

bc bs continues. In conversation with employees there yesterday, I saw history being revised as we spoke. by the time the comments from bc were in the paper today they were totally different than what I had been told as one of the 300,000 now exposed.

The employee was a male. Supposedly several days after the theft BC "destroyed" the files that had been on the computer and did this for the next 'several days". On January 23 the hard drive "self destructed".

I was told that it was "policy" that laptops with this kind of info left their premises and now that is being reconsidered.

yesterday it was made very clear that they are not sure if medical data was on the computer or not. Today, in their press remarks it is being presented as if no medical data was on the computer.

So... what was the role of the person walking around with all our info exposed? I was also told that no one had asked the person if medical data was on the computer.
it's a nice distraction to have Experian provide tracking.

What about BC providing internal tracking to the 300,00 for the possible exposure of policy info and access.

What a perfect storm for a shady practitioner to bill thru the stolen policy using universal claims forms and for BC to pay on the "claim" to that person who generously then shares with the thief.

Meanwhile...the legit policy holder has brand new medical codes slammed on them, blue cross math already questionable becomes even more screwed up and no one at Experian will be protecting or guarding or informing about that.
Blue is offering scant protection and a major distraction from what is really the most serious exposure here. why is that not surprising?

Anonymous said...

I saw history being revised as we spoke.

If you received false information you might seriously consider filing a complaint with your legislator/assemblyman and request that they investigate Horizon for allegedly giving out false information to the policy holders that may now be victims of identity theft or worse.