BlueCross BlueShield of Tennessee Data Breach 2025: 780 Affected · Virtual ID Card Misdelivery · TN. Filed With HHS OCR. What To Do.

BlueCross BlueShield of Tennessee (BCBST) filed a HIPAA breach notification with the U.S. Department of Health and Human Services Office for Civil Rights on December 26, 2025, reporting 780 affected individuals in an Unauthorized Access/Disclosure event categorized on the OCR portal as occurring at Email.

The underlying event was an internal administrative error, not an external cyberattack. According to BCBST’s own press release, a single plan member inadvertently received virtual ID cards belonging to roughly 780 other members covered by the same employer group plan. No other BCBST members were impacted, and BCBST has stated the disclosure did not include financial information, dates of birth, or Social Security numbers.

Timeline

• October 28, 2025 — The misdelivery occurred. Virtual member ID cards for approximately 780 employer-plan members were sent to a single unauthorized recipient who was also covered under the same employer plan.
• October 29, 2025 — BCBST identified the error the following day.
• December 26, 2025 — BCBST issued a public statement, began mailing individual notification letters to the 780 affected members, and filed the breach with HHS OCR. The OCR portal classifies the breach location as Email and the type as Unauthorized Access/Disclosure.

The roughly two-month gap between discovery and individual notification falls within HIPAA’s 60-day outer limit for breaches affecting fewer than 500 people in a single jurisdiction; for breaches at or above the 500-individual threshold the 60-day clock applies to each affected individual.

What was exposed

Per BCBST’s notice, the information available on the virtual member ID cards included:

• Member name
• BCBST member ID number
• Address
• Group number

BCBST has explicitly stated that Social Security numbers, dates of birth, and financial account information were not on the virtual ID cards and were not exposed. The HHS OCR portal nevertheless logs the breach under “Email” because the virtual cards were delivered electronically.

What BCBST is offering

BCBST is offering complimentary identity monitoring services to the 780 affected members. Members with questions can reach the BCBST Privacy Office at 1-888-455-3824 (8:30 a.m.–4:30 p.m. ET, Monday–Friday) or by emailing [email protected].

Class-action posture

As of this writing, no class action specific to the 780-member virtual ID card incident has been publicly filed. Plaintiffs’ firms have been more active around BCBST’s separate exposure through the Conduent Business Services vendor breach (October 2024 – January 2025), which is a distinct incident affecting different members and involves Social Security numbers. Members reviewing legal options should be careful to identify which incident any class-action notice references.

What to do if you may be affected

• Activate the offered identity monitoring. If you received a notification letter from BCBST referencing the virtual ID card incident, enroll in the complimentary coverage. It is paid for and adds nothing to your risk profile.
• Freeze your credit with Equifax, Experian, and TransUnion. The data elements exposed in this specific incident are lower-sensitivity than SSN-plus-DOB combinations, but a freeze remains the highest-leverage protective step against identity theft generally, and it is free.
• Watch for targeted phishing or impersonation. Because the disclosed data includes member ID and group number, a follow-on attacker who obtained the leaked information could craft convincing benefits-related lures. Do not act on emails or calls claiming to be from BCBST without verifying through the phone number on your insurance card or by signing in to your BlueAccess account directly.
• Confirm which incident applies to you. BCBST members have been affected by multiple unrelated 2024–2025 incidents (the Conduent vendor breach, the Berkeley Research Group vendor incident, and this virtual ID card error). Read your notification letter carefully — the specific data elements listed will tell you which incident is being notified.
• Keep the notification letter. It establishes your standing if a class action is later filed and certified.

Sources on this page

• HHS Office for Civil Rights Breach Portal — the federal regulatory record of this breach (filing date December 26, 2025; 780 individuals; type Unauthorized Access/Disclosure; location Email).
• BCBST News Center — Privacy Incident Impacts 780 BlueCross Members — BCBST’s primary public statement describing the incident, the data elements involved, and the identity monitoring offer.
• BCBST Personal Data page — BCBST’s standing privacy and security reference for members.
• BCBST News Center — Data Breaches Potentially Impact Individuals with BCBST Coverage — context distinguishing this incident from the separate Conduent vendor breach that has driven 2025 class-action activity.