2025 Google Analytics misconfiguration — 4.7M
Data compromised
Insurance plan details, medical claim information, patient names, provider search criteria
Technical writeup
Blue Shield of California disclosed that Google Analytics was misconfigured between April 2021 and January 2024, inadvertently sharing protected health information with Google Ads. Exposed data included insurance plan details, medical claim information, patient names, and provider search criteria.
Root cause
Misconfigured Google Analytics; PHI shared with Google Ads.