The Montana Office of the Commissioner of Securities and Insurance hosted an administrative hearing Jan. 22 to address a data breach that affected BCBS Montana, owned by Health Care Service Corp.
The hearing comes in the wake of a cybersecurity incident affecting third-party business services provider Conduent. James Brown, state auditor and commissioner of securities and insurance, launched an investigation into BCBS Montana after learning of the incident in October. The leak exposed sensitive data of up to 462,000 Montanans from late 2024 through the beginning of 2025.
A Jan. 22 news release from the commissioner’s office said BCBS Montana tried securing a temporary restraining order to stop the hearing from taking place, but the Lewis and Clark County District Court denied the request.
“It is troubling that it appears BCBSMT attempted to avoid regulatory oversight and accountability by seeking to block this hearing through the courts,” a BCBS Montana spokesperson said in the release. “Our office is committed to protecting Montanans and ensuring a fair, transparent and very serious process when sensitive personal and health data may have been placed at risk. That is exactly what this hearing was designed to do. Our office will consider all the evidence and then issue a final order in due course.”
The hearing sought to determine whether the insurer followed timely reporting laws, regardless of third-party involvement. The news release said evidence pointed to BCBS Montana knowing about a possible breach in January 2025, even though the insurer did not inform the commissioner’s office until the fall.
A hearing examiner will suggest a decision for the commissioner to review and execute.
The commissioner previously said his team was under the impression that Conduent would be responsible for contacting customers. The payer also said its own systems were not impacted. The insurer told Becker’s Jan. 23 that it does not comment on pending litigation.
