CMS notifies close to 1 million individuals of cyber breach
Files containing protected health information, such as Medicare claims data were compromised in a cyberattack involving MOVEit.
Photo: eclipse/Getty Images
The Centers for Medicare and Medicaid Services and Wisconsin Physicians Service Insurance Corporation are mailing written notifications to 946,801 people whose protected health information or other personally identifiable information may have been compromised in a cyber breach.
A security vulnerability was found in MOVEit software, a third-party application used in the transfer of files to CMS. The app was developed by Progress Software and used by Wisconsin Physicians Service Insurance Corporation.
Progress Software discovered and disclosed the vulnerability in the MOVEit software to the public on May 31, 2023. It released a software patch that WPS applied.
In the initial investigation, WPS did not observe evidence that an unauthorized party obtained copies of files that were within the WPS MOVEit application. But this May, acting on new information, WPS conducted an additional review with the assistance of a third-party cybersecurity firm.
On July 8, when evaluating a different portion of the impacted files, WPS determined that between May 27 and 31, 2023, an unauthorized third party copied files from WPS's MOVEit file transfer system.
On the same day, WPS notified CMS that files containing protected health information, such as Medicare claims data, and related personally identifiable information, had been compromised.
There has been no evidence of further activity by an unauthorized party after the patch was applied in early June 2023.
WHY THIS MATTERS
Compromised information may include names, Social Security numbers or individual Taxpayer identification Numbers, dates of birth, mailing addresses, information on gender, hospital account number, dates of service and Medicare Beneficiary Identifier (MBI) and/or Health Insurance Claim Number.
CMS said it is continuing to investigate the incident in coordination with WPS in collaboration with law enforcement agencies and cybersecurity forensic consultants.
"CMS and WPS are not aware of any reports of identity fraud or improper use of your Personal Information as a direct result of this incident, however, we are taking this opportunity to notify you so that, if you wish to do so, you can take advantage of the information and resources referenced in this notice," CMS said in the letter.
CMS is providing information on free credit monitoring and is giving those potentially affected a new Medicare card with a new Medicare Number. Medicare benefits and coverage have not been affected.
WPS is offering a complimentary 12 months of credit monitoring and other services from Experian at no cost.
The Federal Trade Commission recommends checking credit reports periodically. Under federal law, individuals are entitled to one free credit report every 12 months. For more information, call 1-877-322-8228 or visit www.annualcreditreport.com.
Individuals who find suspicious activity are asked to call local law enforcement and file a police report.
Further information is available by calling Experian at 833-931-5700 or by calling 1-800-MEDICARE (1-800-633-4227).
THE LARGER TREND
Wisconsin Physicians Service is a CMS contractor that handles Medicare Part A and/or B claims and related services for CMS.
WPS is among many organizations in the United States that have been impacted by the MOVEit vulnerability, CMS said. The security incident may have impacted the personally identifiable information of Medicare beneficiaries that was collected in managing Medicare claims. It may also have affected individuals who are not Medicare beneficiaries when provider data was collected to support CMS audits.
Organizations outside of the U.S. have also been affected by the MOVEit vulnerability, according to the U.K.'s National Cyber Security Centre.
The cyberattack exploited a flaw in the MOVEit managed file transfer service, which is used to securely transfer sensitive files, according to Lepide. The attack began on May 27, 2023 and used a zero-day vulnerability that allowed the hackers to inject SQL commands and access the databases of MOVEit customers, the report said. The hackers were believed to be linked to the Cl0p ransomware group.
The HIMSS Healthcare Cybersecurity Forum is scheduled to take place October 31-November 1 in Washington, D.C. Learn more and register.
Email the writer: SMorse@himss.org
The HIMSS Healthcare Cybersecurity Forum is scheduled to take place October 31-November 1 in Washington, D.C. Learn more and register.
