Technology

Blue Shield exposed 4.7M patients’ health data to Google

Published

8 months ago

April 27, 2025

Blue Shield exposed 4.7M patients’ health data to Google

Healthcare institutions and insurers arguably collect the most sensitive information about you, including IDs, contact details, addresses and medical records. But they often don’t put in the same level of effort to protect that data.

That’s clear from the growing number of healthcare data breaches we’ve seen recently. In most of those cases, a bad actor was involved.

But in the latest news, health insurance giant Blue Shield of California confirmed that it had been sharing private health data of 4.7 million users with Google for three years without even realizing it.

STAY PROTECTED & INFORMED! GET SECURITY ALERTS & EXPERT TECH TIPS — SIGN UP FOR KURT’S THE CYBERGUY REPORT NOW

A person doing a Google search (Kurt “CyberGuy” Knutsson))

What you need to know

Blue Shield of California just admitted to a major data privacy slip that went on for almost three years, from April 2021 to January 2024. It was using Google Analytics to track how people used its member websites. This is totally normal since every business does it. But the tool was accidentally sharing sensitive info with Google Ads because it wasn’t set up properly.

What I find extremely shocking is that it took the company three years to realize it was sharing its user data with Google to run ads. This says a lot about how much these healthcare giants care about protecting your data.

The shared data included a broad array of protected health information (PHI), including names, zip codes, gender, medical claim dates, online account numbers, insurance plan names, group numbers, family data and even search criteria used in its “Find a Doctor” feature.

“Google may have used this data to conduct focused ad campaigns back to those individual members. We want to reassure our members that no bad actor was involved, and, to our knowledge, Google has not used the information for any purpose other than these ads or shared the protected information with anyone,” the company said in a notice on its website.

This incident is not isolated. Over the past few years, healthcare and tech companies have come under scrutiny for similar missteps. The Federal Trade Commission (FTC) and the Department of Health and Human Services (HHS) have already issued warnings about the use of tracking technologies in healthcare, especially those that might expose patient data to third parties without adequate transparency or safeguards.

A Google spokesperson provided the following comment to CyberGuy when asked about the Blue Shield data breach:

“Businesses, not Google, manage the data they collect and must inform users about its collection and use. By default, any data sent to Google Analytics for measurement does not identify individuals, and we have strict policies against collecting private health information (PHI) or advertising based on sensitive information.”

A person working on their laptop (Kurt “CyberGuy” Knutsson)

MALWARE EXPOSES 3.9 BILLION PASSWORDS IN HUGE CYBERSECURITY THREAT

Impact on patients and the industry

Since the data was only shared with Google and not any other party, the overall risk is relatively low, apart from the clear privacy violation. It’s highly unlikely that anyone else will gain access to it, so the chances of the data being misused are slim. Google says it doesn’t allow ads to be served based on sensitive information like health, so there’s a good chance your data wasn’t even used for advertising.

Blue Shield’s case follows a string of similar breaches. Companies like GoodRx, BetterHelp and Kaiser have all faced regulatory and legal consequences for sharing sensitive user data with advertising vendors. Some even settled for millions of dollars. Despite the risks, many healthcare organizations have continued using these tools due to the lack of clear regulatory guardrails, a situation complicated further by a federal court ruling that blocked the Biden administration’s attempts to curb the use of online trackers in healthcare settings.

WHAT IS ARTIFICIAL INTELLIGENCE (AI)?

A person working on a laptop (Kurt “CyberGuy” Knutsson)

HOW TO REMOVE YOUR PRIVATE DATA FROM THE INTERNET

How to protect your health data online

The Blue Shield of California incident is a reminder that even well-known healthcare providers can mishandle sensitive data. While you can’t always control what happens behind the scenes, there are steps you can take to reduce your exposure and safeguard your privacy:

1. Limit what you share on health portals: Avoid entering more personal details than absolutely necessary on insurance or provider websites. Tools like “Find a Doctor” might log your search terms, so keep inputs vague when possible.

2. Use privacy-focused browsers: Browsers like Brave or Firefox offer built-in privacy protections, such as blocking third-party trackers that could expose health-related browsing activity.

3. Turn off ad personalization: Visit Google’s Ad Settings and disable ad personalization. This won’t stop tracking, but it can reduce how your data is used for targeting.

4. Opt out of tracking where possible: Many healthcare sites use cookies and tracking tools. Choose “reject all” or the strictest privacy settings in cookie banners. If a tracking opt-out tool is available, use it.

5. Read privacy policies (yes, really): Look for language like “third-party sharing,” “advertising,” or “analytics.” If a healthcare provider mentions tools like Google Analytics or Meta Pixel, that’s a cue to proceed cautiously.

6. Monitor your accounts and credit: Keep an eye out for unusual insurance claims or medical charges. Set up credit alerts or monitoring services if your provider offers them, especially after a breach.

7. Ask questions: Call or email your healthcare provider or insurer. Ask what tracking tools they use and how they protect your data. The more consumers push for transparency, the more pressure there is to improve standards.

Bonus privacy steps (For extra peace of mind)

If you want to go beyond the basics, here are some additional steps that can help reduce your digital footprint and catch misuse early:

Use a personal data removal service: While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap — and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you. Check out my top picks for data removal services here.

Consider identity theft protection services: If you’re concerned about fraud or medical identity theft, you’ll want to consider using identity theft protection services. Identity theft companies can monitor personal information like your Social Security number, phone number and email address and alert you if it is being sold on the dark web or being used to open an account. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals.

Use strong antivirus software: To guard against malware or phishing attacks that could compromise access to your online health accounts, be sure to use strong antivirus software. The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe. Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices.

Kurt’s key takeaway

It baffles me how careless most companies are when it comes to protecting user data. Blue Shield “mistakenly” shared your data with Google, which then used it to show personalized ads. It took the company three years to realize this. While most cyber incidents involve an attacker, this breach didn’t need one. We need accountability in data practices, especially when human error or tech oversight can cause damage at scale.

How comfortable are you knowing that your health data might be used to target ads? Let us know by writing us at Cyberguy.com/Contact

For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter

Ask Kurt a question or let us know what stories you’d like us to cover

Follow Kurt on his social channels

Answers to the most asked CyberGuy questions:

New from Kurt:

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

Technology

The latest iPad Air is $400 for the first time and arrives by Christmas

Published

18 minutes ago

December 18, 2025

Press Room

The latest iPad Air is 0 for the first time and arrives by Christmas

If you have $400 and want an iPad, your options are usually kind of limited to either just the base iPad, or better yet, the latest iPad Mini — if it happens to be on sale when you’re shopping (it is now, but that’s not always the case). But right now, you should consider getting the 128GB version of Apple’s 11-inch iPad Air with the capable M3 processor. At Target, multiple colors of this model are $399.99, beating the previous low of $449.99 we’ve seen during large-scale deal events. Currently, no other retailer is matching this price. This sale ends Saturday night.

$400 is a sweet price for this model, as it debuted in early 2025 for $600. In terms of how it stacks up to other iPad models, Verge editor-at-large David Pierce said in his impressions that the M3 Air is “exactly what you think it is. Which is fine.” I know, that sounds like a back-handed compliment, but it’s been a while since iPads peaked in terms of utility, design, and fast performance. This one carries the torch in Apple’s tablet dominance, and its M3 processor means it’ll be a fantastic tablet for longer than any other iPad at the $400 price point. Read our in-depth impressions.

Other Verge-approved deals

Technology

Facebook settlement scam emails to avoid now

Published

48 minutes ago

December 18, 2025

Press Room

Facebook settlement scam emails to avoid now

NEWYou can now listen to Fox News articles!

Millions of Facebook users filed claims in a recent privacy settlement after the platform was accused of mishandling user data. The approved payouts have been rolling out, which means people are watching their inboxes for updates. Scammers know this and are sending look-alike emails that push you to click a “Redeem Virtual Card” button. Arlene B emailed us to share what landed in her inbox.

“I received an email stating that it was from (Facebook User Privacy Settlement Administrator) and that I needed to click on the button below to “Redeem Virtual Card.” Do you know if this is a scam or not?”

Her question shows how convincing these fake messages appear. A real settlement did happen, and people have been getting payments. Still, criminals are now piggybacking on the rollout with messages that look official but lead to dangerous sites that steal your information. Let’s walk through how to tell real emails from fake ones.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

NEW SCAM SENDS FAKE MICROSOFT 365 LOGIN PAGES

Scammers send fake settlement emails that mimic the real payout notices to trick you into clicking. (Kurt “CyberGuy” Knutsson)

How to check if your Facebook settlement email is legitimate

Scammers rely on confusion and urgency. These steps help you confirm the message before you click anything.

Confirm the sender’s address

Real settlement emails come from facebookuserprivacysettlement@notifications.kroll.com. Kroll is the official administrator.

Look for your claimant ID

Real notices include your unique claimant ID and reference the claim you filed last year. Fake emails skip this personalized detail.

Check where the link leads

Real payout links go to DigitalPay / Veritas or domains tied to krollsettlementadministration. If the link points to a strange or shortened URL, it is likely unsafe.

Watch for common red flags

Pressure to act right away. Clumsy wording or spelling mistakes. A button that goes to a suspicious URL. You never filed a claim in the first place. Any sender address that is not the official Kroll domain.

Remember that you are not required to click anything

If your claim was approved, you have already received a legitimate notice. Emails that say you must “redeem” again or “confirm” payment are signs of a scam.

GEEK SQUAD SCAM EMAIL: HOW TO SPOT AND STOP IT

A quick hover over the “Redeem Virtual Card” button often reveals a suspicious link that gives the scam away. (Kurt “CyberGuy” Knutsson)

Why scammers target large settlements

Whenever a major payout occurs, criminals blend in with legitimate messages because people expect money and may open emails quickly. When fake notices look similar to real ones, it only takes one careless click for scammers to grab your data.

DON’T FALL FOR FAKE SETTLEMENT SITES THAT STEAL YOUR DATA

A person logging onto Facebook (Kurt “CyberGuy” Knutsson)

Ways to stay safe from settlement scams

Use these simple habits to protect yourself from Facebook settlement scams and any future payout scam.

1) Verify the sender every time

Look at the full address. Scammers often change one character in hopes you will not notice.

2) Hover over links before tapping

Check the destination without clicking. A strange URL is your warning sign.

3) Never share sensitive information through email

Real administrators do not ask for banking info or logins.

4) Use a data removal service

Data brokers often collect your email address, phone number and other personal details that scammers use to target victims. A data removal service can pull you out of those databases, which reduces the amount of scam email that reaches you in the first place.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

5) Go directly to the official settlement site

Type in the address yourself instead of using a link from an email.

6) Use strong antivirus software

Good security software blocks dangerous links and pages. The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

7) Delete emails that push urgency

Scammers want fast reactions. Slow down and confirm details.

Kurt’s key takeaways

The Facebook settlement payout created the perfect moment for scammers to slip fake messages into inboxes. Once you know the signs, it becomes much easier to separate real notices from dangerous ones. Stay alert, trust your instincts and verify before you click.

Would you open a payout email if you were not expecting money in the first place? Let us know by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report

Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

Technology

The first Dolby FlexConnect soundbar is coming from LG

Published

12 hours ago

December 17, 2025

Press Room

The first Dolby FlexConnect soundbar is coming from LG

Dolby Atmos FlexConnect technology debuted this year with the TCL Z100 speakers, and now we’re getting our first FlexConnect soundbar thanks to LG. The new H7 soundbar — which runs on the same Alpha 11 Gen 3 chip as LG’s OLEDs and new Micro RGB LED — is a part of the LG Sound Suite, a modular home audio system the company will debut at CES 2026. In addition to the soundbar, the Sound Suite will include the M5 and M7 surround speakers and the W7 subwoofer. All of the speakers feature Peerless Audio components.

The two main drawbacks of TCL’s Dolby FlexConnect implementation were the limitation of only allowing four connected speakers, including a sub, and the need for a 2025 QM series TCL TV. So you needed to pick between better sound coverage with a fourth speaker or more bass performance with a sub. LG’s Sound Suite, on the other hand, will allow you to connect the soundbar with up to four surround speakers and a subwoofer for a potential 13.1.7-channel system.

And while the speakers can be used with a compatible LG TV (including the 2026 premium LG TV lineup and 2025’s C5 and G5 OLEDs), it isn’t required. It’s possible to use the H7 soundbar with any TV — or without — and have it act as what’s called the lead device to connect the surround speakers and sub. LG says there are 27 different speaker configurations possible, from using two speakers as a stereo pair up to the full system with soundbar, surrounds, and sub.

In my experience with the TCL Z100, calibrating FlexConnect speakers to your space is also fast. Once they’re in place and plugged in, a short musical clip is played for a few seconds and then setup is complete. The system is able to know where the speakers are placed and how to optimize the surround and Atmos sound for your room. With other room correction software, the process can take much longer, requiring taking sound readings from multiple locations in the room.

LG is using ultra-wideband technology to adjust the sweet spot based on your listening position that it’s calling Sound Follow. What will be interesting to see with the LG Sound Suite’s Dolby FlexConnect implementation is how customizable it is after setup (for instance, adjusting subwoofer levels).

I’ll be hearing the system at CES and plan on reviewing the system when it’s available to see how well the technology translates into a home.