Blue Cross of California Website Security Cases

Posted in on July 12, 2011

California Judicial Counsel Coordinated Proceeding No. 4647
Orange County Superior Court
Proposed Class Action Settlement

A settlement has been reached with Anthem Blue Cross of California‚ Anthem Blue Cross Life and Health Insurance Company‚ The WellPoint Companies‚ Inc.‚ WellPoint California Services‚ Inc. and WellPoint Behavioral Health‚ Inc. (together called “Blue Cross/Wellpoint” or the “Defendants”) and plaintiffs across the country regarding the potential accessibility of personal and financial information contained on individual health insurance applications.

On February 22‚ 2010‚ an individual Blue Cross of California (“Blue Cross/Wellpoint”) customer wrote the company to inform them their website was disclosing its customers’ personal identifying information and health insurance applications “for anyone to see.” Specifically‚ Blue Cross/Wellpoint’s website had no login or password requirement protecting its customers’ information‚ enabling anyone who presses the “backspace” on the web address to access literally hundreds of thousands of applicants’ medical histories‚ social security numbers‚ home and office addresses‚ telephone numbers‚ credit card numbers and other financial information. Despite the customer’s letter‚ Blue Cross/Wellpoint did not fix the problem. Finally‚ on March 8‚ 2010‚ a class action lawsuit was filed against Blue Cross/Wellpoint and on March 10‚ 2010‚ an Orange County Superior Court issued a temporary restraining order that Blue Cross/Wellpoint must stop their “continued public disclosure of the health insurance applications of the plaintiff and the putative class.”

The risk to Blue Cross/Wellpoint’s customers from the long period of public disclosure is still very real. Investigation conducted by plaintiffs’ counsel in the case revealed that (i) approximately 641‚769 applicants’ information and health records were potential exposed‚ (ii) the period of disclosure was‚ at minimum‚ four (4) and a half months beginning in October 2009; (iii) dozens of unknown internet protocol addresses were recorded as having viewed the Blue Cross/Wellpoint records during the disclosure period; (iv) the amount of information and applications accessed are unable to be determined; and (v) class members need to be especially vigilant about protecting their identities as a result of Blue Cross/Wellpoint’s four (4) month disclosure of their information.

Plaintiffs’ counsel believe the settlement’s protections and benefits will go a long way towards helping the 641‚769 class members combat instances of identity theft and obtain reimbursement for losses suffered from Wellpoint’s disclosure. Those benefits include:

• Two (2) years of free Identity Theft Protection and Insurance (one (1) year if class members previously accepted one free year of credit monitoring offered by Wellpoint);
• Class Members that are actual victims of identity theft or loss receive an additional five years of free Identity Theft Protection and Insurance;
• Reimbursements of all identity theft losses (up to $50‚000) and out-of-pocket expenses stemming from the breach;
• 5 years of additional time to file claims for identity theft losses (to 5/31/16);
• Increased security measures at WellPoint/Anthem Blue Cross; and
• $250‚000 donation to two non-profit organizations that work to protect consumers’ privacy rights.

The Court has decided that the Class includes everyone in the United States‚ including Puerto Rico‚ U.S. Virgin Islands and Guam (1) whose private information was on WellPoint/Anthem Blue Cross’ Affected Servers from 8/15/08-3/10/10‚ or (2) who received a notification letter from WellPoint/Anthem Blue Cross regarding the alleged failure of WellPoint/Anthem Blue Cross to secure their confidential personal and private information.

To sign up for Free Identity Theft Protection and Insurance Coverage‚ class members must go to the website below or call the toll-free phone number (877-527-2354) to enroll by September 28‚ 2011. To ask for reimbursement for identity theft losses and out-of-pocket expenses class members must complete and submit the claims forms found on the website below.

Class members have a choice about whether to stay in the Class or not. If class members do nothing‚ they are choosing to stay in the Class. This means they will be legally bound by all orders and judgments of the Court‚ and won’t be able to sue or continue to sue the Defendants about the same legal claims in this case ever again. If class members don’t want to stay in the Class‚ they must submit a request for exclusion postmarked by October 24‚ 2011. If class members exclude themselves‚ they will not get certain benefits from the settlement‚ but will keep their right to sue. If class members stay in the Class‚ they may object to the settlement by October 24‚ 2011. The Court will hold a hearing in this case (Blue Cross of California Website Security Cases‚ JCCP 4647)‚ on November 14‚ 2011 at Department CX103 of the Orange County Superior Court (Complex Litigation Division)‚ located at 751 West Santa Ana Boulevard‚ Santa Ana‚ California 92701.

For a copy of the Settlement Agreement‚ the Settlement’s detailed notice and Claim Forms‚ as well as an instructional video about how to fill out the Claims Forms‚ go to www.AnthemBlueCrossSecuritySettlement.com.