Insurance · Health Insurance (DMV) · Private litigation + Data breach
CareFirst BlueCross BlueShield
Headline
Hackers got into CareFirst in June 2014 and were not detected for eleven months - and CareFirst only found them because it went looking after Anthem, Premera and Excellus were hacked, not because anything of its own…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Hackers got into CareFirst in June 2014 and were not detected for eleven months - and CareFirst only found them because it went looking after Anthem, Premera and Excellus were hacked, not because anything of its own caught it. Members were notified in May 2015, a year after the intrusion. What happened next is the part that should land for anyone insured in the DMV: CareFirst spent the following decade arguing that having your data stolen is not an injury you can sue over, taking that position all the way to a Supreme Court petition, and a contract class was not certified until 2024 - nine years after the notification letters went out. For the dominant health insurer across DC, Maryland and Virginia, the practical finding is that the legal tail of a breach outlasts most people's time on the plan.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Case status. Private litigation; no sources are on file yet, so no legal tier is assigned.
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass for the base member Terms of Use — the 9-year Attias case's complex procedural history illustrates how long DMV-specific health-data litigation can take to resolve.
Data sharing
A DECADE-LONG LITIGATION SAGA directly relevant to DMV residents: hackers gained access to CareFirst systems in June 2014, exposing data of approximately 1.1 MILLION plan members (names, birthdates, email addresses, subscriber ID numbers) — the intrusion went undetected for MONTHS. The resulting class action (Attias v. CareFirst) was dismissed in 2016 for lack of standing, REVERSED on appeal, then the Supreme Court declined review in 2018, sending it back to the district court. In March 2023 a federal judge (Christopher Cooper) DENIED class certification without prejudice; after the Maryland and Virginia consumer-protection claims were dismissed on partial summary judgment in late 2023, the court in 2024 — roughly a DECADE after the original breach — certified a narrower CONTRACT class covering all DC/Maryland/Virginia residents who had insurance through CareFirst, had data exposed, and were notified in May 2015; the consumer-protection-statute claims under Maryland and Virginia law were separately DISMISSED (the court found no proof of actual identity theft, and DC law doesn't treat protective/mitigation expenses as recoverable 'actual damages'), leaving only the narrower contract claim alive. SEPARATELY, CareFirst is ITSELF a PLAINTIFF (not defendant): on Feb. 21, 2025 it sued Change Healthcare in Maryland state court (per Becker's Payer Issues and The HIPAA Journal) (a UnitedHealth Group subsidiary, also documented via the Optum/OptumRx row in this tracker) over the massive 2024 Change Healthcare ransomware breach, seeking $900,000 in damages plus interest and attorney fees — alleging Change Healthcare's insufficient cybersecurity (no multi-factor authentication on a remote-access portal) let a Russian ransomware group in.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not verified this pass — recommend a direct follow-up
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. NOT VERIFIED THIS PASS. CareFirst, Inc. maintains dual headquarters in Baltimore, MD and Washington, DC, but no privacy-specific mailing address was confirmed against a primary source. Because CareFirst operates through several separately chartered underwriting entities (including Group Hospitalization and Medical Services, Inc. for the DC market), identify the correct entity on your own member ID card or EOB before sending written notice.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy carefirst.com/legal/privacy-policy.html | Not fetched yet | NO (HTML only) |
| Terms of service carefirst.com/legal/terms-of-use.html | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.