Montana BCBS claims insurance commissioner targeting it because of data breach

Darrell Ehrlick | Daily Montanan

January 22, 2026

The largest health insurance company in Montana is fighting against the Montana Commissioner of Securities and Insurance as state officials push to find out more information about the largest data breach in state history, and whether Montana Blue Cross-Blue Shield delayed notifying customers that their personal identifying information, including Social Security numbers, may have been breached.

In a contested hearing on Thursday afternoon, attorneys for Montana Blue Cross-Blue Shield pointed to a filing in district court asking the courts to stop the hearing and process. BCBS also objected to the hearing because it said the office wasn’t properly conducting the hearing, objected that staff attorneys were advising hearing officer David Saunders, who serves as the CSI chief of staff, and said the office was unfairly targeting it, when other companies fell victim to the same breach.

The case stems from a massive data breach by Conduent, which is a third-party vendor to BCBS. In testimony Thursday, exhibits showed that Conduent discovered the breach on Jan. 13, 2025, and notified BCBS on Jan. 17, 2025.

But attorneys for Blue Cross-Blue Shield said it wasn’t until July the company discovered its data — including customer identification — had been breached.

Staff from Commissioner James Brown’s office said BCBS didn’t notify them until Oct. 8, and didn’t begin contacting customers about the breach until Oct. 24, and may have still be informing customers as late as last week.

However, attorneys from BCBS argued they had taken responsibility by informing the insurance commissioner of the breach, and for following through with customers.

But the main issue is the gap in timing, which CSI staff have said was not “reasonable.” Montana law requires insurance companies to notify the state if there is a data breach in a “reasonable” amount of time, but the exact definition of reasonable is not detailed in law.

To read the full article, click here.