Blue Cross and Blue Shield of Texas Data Breach 2025: 12,086 Affected · Blue Access for Members Portal Unauthorized Access. What To Do.

Blue Cross and Blue Shield of Texas (BCBSTX) notified 12,086 members that an unauthorized third party accessed their Blue Access for Members (BAM) portal accounts between November 8, 2024 and March 5, 2025. BCBSTX says it detected the activity on February 11, 2025, and filed a HIPAA breach notification with the U.S. Department of Health and Human Services Office for Civil Rights on April 13, 2025. The Texas Attorney General’s breach notification database picked the incident up two days later, and BCBSTX began mailing individual notification letters on April 18, 2025.

This is the BAM portal incident specifically. It is a separate event from the much larger Conduent vendor breach that also affected BCBSTX members and is the subject of a separate Texas Attorney General investigation.

Timeline

• November 8, 2024 — Unauthorized access to BAM accounts begins, per BCBSTX’s notice.
• February 11, 2025 — BCBSTX detects unusual activity on the BAM portal.
• March 5, 2025 — End of the access window BCBSTX has identified to date.
• April 13, 2025 — BCBSTX files with HHS OCR, listing 12,086 affected and incident type “Unauthorized Access/Disclosure.”
• April 15, 2025 — Breach appears on the Texas Attorney General data breach notification database.
• April 18, 2025 — BCBSTX mails individual notification letters and publishes a substitute notice on its website.

What was exposed

BCBSTX’s notice lists the categories of information that may have been viewed in affected BAM accounts:

• Name, address, date of birth
• Telephone numbers, fax numbers, email addresses
• Service dates
• Medical record numbers
• Health plan beneficiary numbers
• Account numbers
• Medical and dental service and billing information

Plaintiffs’ firms reviewing notification letters have additionally reported that Social Security numbers and driver’s license numbers were included for some members, though those elements are not enumerated in the public substitute notice. The exact data set per individual is listed in the personalized notification letter mailed to each affected member.

What BCBSTX is offering

BCBSTX is offering affected members a complimentary one-year membership in Experian’s IdentityWorks identity-theft detection and resolution service. Enrollment instructions and an activation code are included in each individual notification letter. BCBSTX has not publicly disclosed an extension beyond the one-year term.

Class-action status

As of this writing, multiple plaintiffs’ firms — including Strauss Borrelli PLLC and Federman & Sherwood — have publicly opened investigations into the BAM portal incident and are soliciting affected members. No consolidated class action filing tied specifically to the 12,086-member BAM incident has been confirmed on the public docket. The Conduent-related litigation is being tracked separately and is not the same case.

What to do if you may be affected

• Read the notification letter carefully. Your letter lists the specific data elements exposed for your account, which may include items beyond the substitute notice (such as Social Security number).
• Activate the Experian IdentityWorks coverage using the code in your letter. It is free for one year and includes credit monitoring and identity-restoration support.
• Freeze your credit with all three nationwide consumer reporting agencies. A freeze is free, takes about ten minutes per bureau, and is the single highest-leverage step against new-account identity theft.
• Change your Blue Access for Members password and enable any available multi-factor authentication on the account. If you reused the password elsewhere, change it on those sites too.
• Watch your Explanation of Benefits statements for medical services you did not receive. Report anything unfamiliar to BCBSTX member services using the number on the back of your insurance card.

Sources on this page

• HHS Office for Civil Rights Breach Portal — the federal regulatory record of this breach.
• BCBSTX — Notice for Blue Access for Members Data Incident — the entity’s own substitute notice.
• Strauss Borrelli PLLC — BCBSTX Data Breach Investigation — plaintiffs’ firm summary of exposed data categories.
• Federman & Sherwood — BCBSTX Data Breach Investigation — plaintiffs’ firm summary of timeline and affected count.
• ClaimDepot — Blue Cross Blue Shield of Texas Data Breach Impacts 12,086 Texans — independent summary of the Texas AG filing.
• University of Texas at Arlington — BCBSTX Data Breach notice — employer-side notice corroborating the timeline.