Excellus BlueCross BlueShield Data Breach Litigation

Fero, et al. v. Excellus Health Plan Inc. and Lifetime Healthcare, Inc., et al.
United States District Court for the Western District of New York
Case No. 6:15-cv-06569

Case Overview

On October 6, 2015, Keller Rohrback L.L.P. filed a class action lawsuit against Excellus BlueCross BlueShield alleging the health care provider (1) failed to implement security measures designed to prevent this attack; (2) failed to employ security protocols to detect the breach; and (3) failed to maintain basic security measures that would have ensured that data would be harder to access or steal, particularly given the fact that their systems harbor medical and other private data. On November 9, 2015, all related cases proceeding in the United States District Court for the Western District of New York were consolidated as the litigation entitled, Fero, et. al. v. Excellus Health Plan Inc., et al.

On April 15, 2016, Plaintiffs filed their Consolidated Master Complaint. The Defendants responded with a Motion to Dismiss.  On February 22, 2017, the Court issued its Decision and Order granting, in part, and denying, in part, the Defendants’ motion.  The Court maintained claims for breach of contract and negligent misrepresentation in its decision.  In March 2017, the Plaintiffs moved the Court asking for reconsideration of certain portions of the February 22 ruling.  On January 19, 2018, the Court issued a decision on reconsideration, reinstating claims brought by several Plaintiffs who had not alleged that they had suffered any misuse of their personally identifiable information and likewise denying Defendants’ motion to dismiss these Plaintiffs’ claims.

Case Status

The Plaintiffs filed their Amended Consolidated Master Complaint in March 22, 2018.  Both Defendants, Excellus and Blue Cross filed their Answers on April 23, 2018.  The litigation is now moving into the discovery phase.  Discovery consists of the many activities to further the litigation and the assembly of evidence related to the issues and the claims that ate being pursued.

Who was affected?

As many as 10 million of Excellus clients, most of whom reside in upstate New York, may have been exposed in an attack dating back to 2013. Members of other Blue Cross Blue Shield plans who sought treatment in Excellus’ service area may also have been affected. Additionally, subscribers of the following other affiliates may have been affected: Lifetime Benefit Solutions, Lifetime Care, Lifetime Health Medical Group, The MedAmerica Companies and Univera Healthcare.

We urge you to visit this website as it will be updated as the litigation progresses.

Other Information

Protecting Your Private Information

The Federal Trade Commission’s website is a great resource for information on immediate steps to take if you’ve been exposed to a data breach: https://www.identitytheft.gov

< Back