CareFirst Hit With Class Action Over Second Data Breach

Health insurance provider CareFirst, Inc. was hit with a class action lawsuit due to the data breach that occurred in May, which allegedly compromised the confidential information of about 1.1 million individuals.

The CareFirst Blue Cross Blue Shield class action lawsuit was filed in a Maryland federal court on Aug. 6 by plaintiffs Pamela Chambliss of Maryland and Scott Adamson of Delaware. Both plaintiffs had health insurance policies through CareFirst at the time of the data breach.

Chambliss and Adamson claim that the data breach compromised their own personal information and they are now at risk for identity theft and fraud because of it.

“The breach involves the theft of information stored on various computers and data storage devices, and according to CareFirst, it potentially involves scores of records,” the plaintiffs explain in their CareFirst class action lawsuit.

“Upon information and belief, CareFirst did not encrypt the [personal information] in its possession and was viewed as a ‘soft target’ by hackers,” they added.

Chambliss and Adamson claim that because CareFirst was not able to keep their personal information safe and secure, it puts them at risk for falling victim to various crimes that are committed by identity thieves, including immigration fraud, driver’s license fraud, welfare fraud and tax fraud.

“In addition, identity thieves may obtain services using plaintiffs’ confidential health information and [personal information], or commit any number of frauds, such as obtaining a job or procuring housing,” the plaintiffs add.

“The United States government and privacy experts acknowledge that it may take years for identify theft to come to light and be detected,” they wrote in their data breach class action lawsuit.

Chambliss and Adamson explain that this was not the first data breach that struck CareFirst. The insurer also faced a data breach in June 2014, which means that the company should have been more vigilant, they argue.

“The data breach at issue in this case occurred despite the fact that CareFirst was on notice of security problems,” the plaintiffs say in the data breach class action lawsuit.

They go onto explain that after the data breach in 2014, the company hired a security firm that was supposed to help CareFirst “correct its security deficiencies,” but despite this help CareFirst failed, which resulted in the second data breach.

Chambliss and Adamson are looking to represent a nationwide class of individuals who’s personal information was compromised as a result of the May data breach.

The data breach class action lawsuit charges CareFirst with negligence, breach of implied contract, unjust enrichment, declaratory judgement, and with violating Maryland’s Personal Information Protection Act.

The plaintiffs are represented by Price O. Gielen of Neuberger Quinn Gielen Rubin & Gibber PA, William B. Federman of Federman & Sherwood and Cornelius P. Dukelow of Abington Cole & Ellery.

Counsel information for CareFirst is not yet available.

The CareFirst Data Breach Class Action Lawsuit is Chambliss et al v. CareFirst, Inc. et al., Case No. 1:15-cv-02288, in the U.S. District Court for the District of Maryland.