Notice of Welltok data privacy event

On October 13, 2023, Blue Cross and Blue Shield of North Carolina (“Blue Cross NC”) learned that Welltok, Inc. (“Welltok”), a subcontractor of our pharmacy vendor Prime Therapeutics, experienced a data security incident in which an unauthorized party accessed the data of customers, including some Blue Cross NC Medicare members. This incident involved the third party MOVEit Transfer tool, which is used to securely exchange files.

On July 26, 2023, Welltok was alerted to an earlier alleged compromise of their MOVEit Transfer software. Welltok promptly launched an internal investigation, with the assistance of third-party cybersecurity specialists, to determine the potential impact to the security of data housed on the MOVEit Transfer server. The investigation determined on August 11, 2023, that an unknown actor exploited vulnerabilities, accessed the MOVEit Transfer server on May 30, 2023, and exfiltrated certain data from the MOVEit Transfer server during that time. Welltok subsequently undertook a time-consuming and detailed review of the data stored on the server at the time of this incident to understand the contents of that data and to whom that data relates. 

Although the type of information at issue varies for each person, the following types of information may have been impacted by this incident: member name, member ID, date of birth, address, phone number, Client ID, carrier ID, Account ID, Group ID, and medication. While Welltok has no evidence that any of the information has been misused, impacted members are being notified by Welltok beginning in mid-November and are being provided information and resources to help protect their personal information.

As part of Welltok's ongoing commitment to the security of information, they are reviewing and enhancing their existing policies and procedures related to data privacy to reduce the likelihood of a similar future event. In addition to notifying impacted individuals, they are offering credit monitoring and identity protection services.

For more information, please visit the Welltok notice about this event. 

If you have questions or would like additional information, please call Welltok's dedicated assistance line at 800-628-2141 between the hours of 6 AM and 8 PM Pacific Time, Monday through Friday, and on Saturday and Sunday between the hours of 8 AM and 5 PM Pacific Time excluding major US holidays. Be prepared to provide engagement number B107737.