Montana Judge Greenlights Investigation into BCBSMT Data Breach Affecting 462,000 Members
A Montana state district judge in Helena has ruled in favor of the Montana State Auditor’s Office, allowing its investigation into a data breach at Blue Cross Blue Shield of Montana (BCBSMT) to proceed. Judge Chris Abbott dismissed a lawsuit filed by BCBSMT’s parent company, Health Care Service Corporation (HCSC), which had challenged the auditor’s authority to probe the incident.
The breach, disclosed in October, exposed the personal data of up to 462,000 BCBSMT members roughly one-third of Montana’s population after a cyber incident at Conduent, a third-party vendor. The auditor’s office, led by State Auditor James Brown, launched an investigation to determine whether BCBSMT complied with state laws requiring timely breach notifications.
HCSC argued that BCBSMT was exempt from Montana’s reporting requirements under federal law, citing a pre-October 1 effective date for House Bill 60 a 2023 law that closed the exemption loophole. The company contended its July 1 discovery of the breach and September 23 assessment fell outside the new law’s scope, calling its notification to the auditor’s office a "courtesy." However, Judge Abbott ruled that the company must first complete the administrative process before challenging the investigation in court.
The auditor’s office held a public hearing in January, with a hearing examiner now expected to resume work on findings, including potential violations and penalties. Brown emphasized the state’s commitment to enforcing privacy protections, stating the ruling allows the investigation to move forward without further delay. A final decision on compliance and any enforcement actions will rest with the auditor’s office.
Source: https://missoulacurrent.com/bcbs-data-breach/
Conduent cybersecurity rating report: https://www.rankiteo.com/company/conduent
"id": "CON1776790111",
"linkid": "conduent",
"type": "Cyber Attack",
"date": "4/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '462,000',
'industry': 'Healthcare',
'location': 'Montana, USA',
'name': 'Blue Cross Blue Shield of Montana (BCBSMT)',
'type': 'Health Insurance Provider'}],
'data_breach': {'number_of_records_exposed': '462,000',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': 'Personal data'},
'date_detected': '2023-07-01',
'date_publicly_disclosed': '2023-10',
'description': 'A Montana state district judge ruled in favor of the Montana '
'State Auditor’s Office, allowing its investigation into a '
'data breach at Blue Cross Blue Shield of Montana (BCBSMT) to '
'proceed. The breach exposed the personal data of up to '
'462,000 BCBSMT members after a cyber incident at Conduent, a '
'third-party vendor.',
'impact': {'data_compromised': 'Personal data of 462,000 members',
'identity_theft_risk': 'High'},
'investigation_status': 'Ongoing',
'post_incident_analysis': {'root_causes': 'Cyber incident at third-party '
'vendor (Conduent)'},
'references': [{'source': 'Montana State District Judge Ruling'}],
'regulatory_compliance': {'legal_actions': 'Lawsuit filed by HCSC challenging '
'the auditor’s authority',
'regulations_violated': 'Potential violation of '
'Montana’s breach '
'notification laws (House '
'Bill 60)',
'regulatory_notifications': 'Notification to the '
'Montana State '
'Auditor’s Office'},
'response': {'communication_strategy': 'Notification to the auditor’s office '
'as a courtesy'},
'title': 'BCBSMT Data Breach Affecting 462,000 Members',
'type': 'Data Breach'}