It’s been more than a year since news of the MOVEit breach first emerged, and we’re still getting information on new victims.
The latest firm to add to the list is The Centers for Medicare & Medicaid Services (CMS), a US federal agency within the U.S. Department of Health and Human Services (HHS) that oversees the nation’s major healthcare programs, including Medicare, Medicaid, and the Children’s Health Insurance Program (CHIP), and so plays a critical role in administering health coverage to millions of Americans.
The agency has now confirmed suffering a data breach incident as a result of the MOVEit vulnerability that saw sensitive data belonging to 3,112,815 people stolen. Many of those are either deceased, or not Medicare beneficiaries, since CMS only notified roughly 950,000 people.
Personally identifiable information stolen
In the breach notification letter, which was also sent to the HHS, CMS said crooks took people’s names, social security numbers, individual taxpayer identification numbers, birth dates, mailing addresses, gender data, hospital account number, dates of service, Medicare beneficiary identifiers, and health insurance claim numbers.
This is more than enough data to mount identity theft or phishing attacks that could result in even more disruptive attacks.
CMS explained that it patched its MOVEit Transfer instance in early June last year, and assumed it would be safe. However, by the time the patch was installed, Cl0p operatives had already extracted all of the information they needed, and CMS only realized that in May this year.
Last year, ransomware operators Cl0p found a flaw in the managed file transfer service and used it to steal sensitive data from hundreds of organizations around the world, leading to the SEC launching a full investigation.
Via BleepingComputer
