The Colorado Department of Health Care Policy and Financing (HCPF) has revealed that the personal information of millions of individuals was compromised in a data breach resulting from the recent MOVEit cyberattack.
On Friday, HCPF informed the Maine Attorney General’s office that it has started informing close to 4.1 million individuals that their personal information might have been compromised in the incident.
In a sample notification letter submitted to authorities, HCPF revealed that, on May 28, an unauthorized party accessed certain HCPF files that IBM, which is providing certain services to the organization, was transferring using MOVEit.
Those files contained the personal information of both Health First Colorado (Medicaid) and Child Health Plan Plus members.
The exposed information, the organization says, includes names, addresses, birth dates, Social Security numbers, demographic or income information, medical information, treatment information, and health insurance information.
“Upon discovering the event, HCPF moved quickly to investigate the incident, confirm that no HCPF systems were impacted, and identify potentially affected individuals,” HCPF says.
On August 11, the agency started notifying the potentially impacted individuals of the data breach, offering free credit monitoring and identity restoration services, along with guidance on how they can protect themselves against identity theft and fraud.
Last week, the Missouri Department of Social Services (DSS) announced that it was impacted by the MOVEit hack. The same as HCPF, the DSS data breach occurred through IBM.
In May, Progress Software announced that a zero-day vulnerability had allowed cybercriminals to steal information transferred through the MOVEit Transfer managed file transfer (MFT) software.
According to data from cybersecurity firm Emsisoft, as of August 12, 2023, more than 660 organizations were impacted – directly and indirectly – by the MOVEit hack. The personal and health information of over 46 million people was affected.
Some of the organizations known to have been hit include government services firm Maximus, the US Department of Energy, Louisiana’s Office of Motor Vehicles, Norton parent company Gen Digital, Siemens Energy, Schneider Electric, and energy giant Shell.
Update: Responding to a SecurityWeek inquiry, an IBM spokesperson said:
IBM has worked closely with the Colorado Department of Health Care Policy and Financing (HCPF) and the Missouri Department of Social Services to determine and minimize the impact of the breach of MOVEit Transfer, a non-IBM data transfer program provided by Progress Software. Upon receiving notification of the breach from Progress, we moved quickly to isolate potentially impacted systems and have implemented a thorough mitigation plan. There has been no impact to IBM systems.
Related: Ransomware Group Starts Naming Victims of MOVEit Zero-Day Attacks
Related: MOVEit: Testing the Limits of Supply Chain Security
Related: MOVEit Customers Urged to Patch Third Critical Vulnerability
More from Ionut Arghire
- Generative AI Startup Nexusflow Raises $10.6 Million
- Researchers Extract Sounds From Still Images on Smartphone Cameras
- Hackers Set Sights on Apache NiFi Flaw That Exposes Many Organizations to Attacks
- Cloudflare Users Exposed to Attacks Launched From Within Cloudflare: Researchers
- FBI Warns Organizations of Dual Ransomware, Wiper Attacks
- Lumu Raises $30 Million for Threat Detection and Response Platform
- Cisco Warns of IOS Software Zero-Day Exploitation Attempts
- Russian Zero-Day Acquisition Firm Offers $20 Million for Android, iOS Exploits
Latest News
- Bankrupt IronNet Shuts Down Operations
- AWS Using MadPot Decoy System to Disrupt APTs, Botnets
- Generative AI Startup Nexusflow Raises $10.6 Million
- In Other News: RSA Encryption Attack, Meta AI Privacy, ShinyHunters Hacker Guilty Plea
- Researchers Extract Sounds From Still Images on Smartphone Cameras
- National Security Agency is Starting an Artificial Intelligence Security Center
- CISA Warns of Old JBoss RichFaces Vulnerability Being Exploited in Attacks
- Hackers Set Sights on Apache NiFi Flaw That Exposes Many Organizations to Attacks
