WellPoint (Independent Clinics of Washington, Elevance Health) Data Breach Notice (Washington Attorney General)

The filing from the Washington Attorney General establishes that on June 24, 2025, a breach at WellPoint (Independent Clinics of Washington, Elevance Health) exposed the records of 12,017 people. The organization did not notify affected Washington residents until June 02, 2026 — 343 days later.

Eleven months passed between the incident and the notification

That interval is the single most concrete fact in the record. State and federal rules give organizations time to investigate and contain an incident before they must notify individuals, so the gap does not automatically mean misconduct. It does mean that for nearly a year the people whose information was taken had no way to know their records were no longer private.

What was exposed and what it permanently enables

The filing lists six categories: name, Social Security number, driver’s license or Washington ID card number, full date of birth, health insurance policy or ID number, and medical information. No passwords were exposed.

A Social Security number paired with a date of birth is the exact combination lenders, credit issuers, and many government agencies use to open new accounts. Once that pair is loose, it cannot be changed. You cannot get a new Social Security number the way you can replace a credit card. The same permanence applies to your date of birth and, in most cases, your driver’s license number. These pieces of information remain valid for identity theft and fraud for decades.