HELENA — The office of Montana State Auditor James Brown, the state's commissioner of securities and insurance, has launched an investigation into Blue Cross Blue Shield of Montana (BCBSMT) following a major data breach. According to the Auditor’s Office, the breach puts the personal and medical information of up to 462,000 Montana customers at risk.
"The amount of people that may have been impacted by this data breach, by this third-party provider — it's just staggering, it's unbelievable," Brown told MTN Wednesday.
BCBSMT is the largest health insurer in Montana. The company said in a statement to MTN that the breach was connected to Conduent, one of its vendors.
(WATCH: Blue Cross Blue Shield of Montana investigated over data breach)
"Blue Cross and Blue Shield of Montana was notified by Conduent that some of our member data was impacted by a cyber incident at Conduent," the statement said. "Conduent provides mail room and other services to several organizations. BCBSMT systems were not impacted by this incident. We are committed to supporting our members and working with them through this incident."
According to Brown's office, BCBSMT reported to the state that the breach may have exposed names, addresses, birth dates, billing and medical data, phone numbers, and other sensitive information, in late 2024 and early 2025.
Brown told MTN that BCBSMT reported the incident to his office Oct. 8. He said the company has said affected customers will be notified and offered credit monitoring, but that the auditor's office still has questions about whether that's happened yet.
"The purpose of disclosure under Montana law is to notify Montanans who may have been harmed that they've been harmed, so that they can take steps to mitigate the harm and to find out what's happened with their information," he said. "So that's the reason I opened up this investigation."
Brown said state law requires regulated businesses to provide notification of data breaches in a timely manner, but that it's not clear about exactly what "timely" means.
A spokesperson for BCBSMT told MTN Conduent is going to be directly contacting people who may have been affected by the breach.
Affected consumers are urged to carefully review Explanation of Benefits statements and report suspicious activity immediately. For information and support, visit the Montana Commissioner of Securities and Insurance website or contact BCBSMT’s dedicated member support line.
"We all have a duty to make sure that Montanans are protected, whether you're a government regulator or if you are a company," Brown said. "We should be working together on that to make sure that Montanans aren't harmed — and if they are harmed, to make sure that the steps that are needed to remedy that are taken."
Editor's note: This story has been updated to include a comment and additional information from Blue Cross and Blue Shield of Montana, and updated quotes from State Auditor James Brown.
