Excellus BlueCross BlueShield was targeted by hackers, initially on December 23, 2013, according to the company.

The company said that it learned on August 5, 2015 that cyberattackers had executed a “sophisticated attack” to gain unauthorized access to its information technology (“IT”) systems. Excellus added that its investigation revealed that the initial attack had occurred on December 23, 2013.

According to the company, the attackers “may have gained unauthorized access to individuals' information, which could include name, date of birth, Social Security number, mailing address, telephone number, member identification number, financial account information, and claims information.”

The incident also affected members of other Blue Cross Blue Shield plans who sought treatment in the 31 county upstate New York service area of Excellus BCBS – as well as individuals who do business with Excellus and provided it with their financial account information or Social Security number.