A lawsuit against Blue Cross Blue Shield of Montana regarding data breach
A class action lawsuit has been initiated against Blue Cross Blue Shield of Montana (BCBSMT), claiming that the insurer failed to secure sensitive personal information during a data breach.
This development follows an investigation by Montana Comptroller and Securities and Insurance Commissioner James Brown into a breach involving a third-party company partnered with BCBSMT.
Why this matters
The lawsuit accuses BCBSMT of negligence in safeguarding its members’ personal and medical information, putting them at risk for identity theft and fraud. Reportedly, the company has not yet informed its members about the breach or the risks associated with the compromised data.
The plaintiffs claim negligence, invading privacy, breach of implied contract, violation of the Montana Consumer Protection Act, and unjust enrichment, as noted in the legal filing.
Key information
Attorneys from Western Justice Associates filed the complaint in the U.S. District Court for the District of Montana on behalf of their clients. The lawsuit names Healthcare Services Corporation, the entity that oversees Blue Cross Blue Shield licenses across five states, including Montana.
A data breach at the third-party vendor Conduent from November 2024 to March 2025 resulted in the exposure of personal and health information for approximately 462,000 Montanans.
This compromised data may include names, social security numbers, dates of birth, phone numbers, billing and medical records, treatment and diagnosis codes, provider names, and billing amounts. Such information could potentially be exploited by malicious actors for fraud and identity theft, according to the filing.
BCBSMT reportedly wrapped up an investigation into the breach’s impact on September 23, 2025, and informed the Montana Office of the Comptroller in early October.
Despite being aware of the breach for several months, plaintiffs argue BCBSMT has yet to notify its members.
The lawsuit cites reports from the Federal Trade Commission and CreditCards.com, indicating that the implications of BCBSMT’s failure to safeguard members’ data could be severe and long-lasting.
The filing asserts that BCBSMT “should have known” that its members’ sensitive personal information was valuable to those with illicit intentions. Once this kind of information is stolen, its misuse can inflict lasting harm on affected members, it states.
In a prior statement, Brown deemed the breach not merely a technical mistake but a serious incident with extensive repercussions for Montana’s residents. He also stated that BCBSMT’s lack of timely notification to customers raised concerns, and measures are being taken to ensure accountability and transparency.
BCBSMT acknowledged that some member data was compromised due to a cyber attack on a third-party vendor but maintained that their own systems remained secure.
The lawsuit claims that the plaintiffs have experienced damages or face heightened risk due to the breach, including financial losses and time spent dealing with the implications of identity theft and fraud. They also assert a potential risk of further breaches tied to BCBSMT’s inadequate protective measures.
At least one plaintiff reported noticing “suspicious activity” concerning his Social Security number this year.
Given BCBSMT’s record of failing to prevent such breaches, plaintiffs believe it is essential to ensure that their data remains secure and protected from future theft.
When approached for comments on the court filing, Blue Cross Blue Shield declined to discuss ongoing litigation.
Next steps
The court will assess whether BCBSMT had an obligation to implement adequate cybersecurity measures to protect sensitive personal data and to provide timely warnings if that information had been breached.
The plaintiffs also seek a ruling on whether BCBSMT breached its obligations by not taking “reasonable precautions” to protect this information and if it demonstrated negligence by failing to adopt effective data security practices, thus violating Montana’s consumer protection law.
UPDATE 10/24/2025 at 1:08 pm: This story has been updated with a comment from Blue Cross Blue Shield.
Have an announcement or news to share? Contact the Newsweek Healthcare team at health.care@newsweek.com.
