Wisconsin Physicians Service Insurance Corporation (WPS) is notifying roughly 950,000 individuals that their personal information was stolen in the MOVEit campaign last year.
The MOVEit hack was disclosed in May 2023, after Progress Software discovered that the Russian-speaking Cl0p ransomware group had exploited a zero-day in the MOVEit Transfer managed file transfer (MFT) software to access customer data.
According to cybersecurity firm Emsisoft, close to 2,800 organizations were affected by the hack. The attackers stole the personal information of roughly 96 million people.
On September 6, WPS revealed impact from the MOVEit hack, announcing that 946,801 Medicare beneficiaries in the US were likely affected, including some Centers for Medicare & Medicaid Services (CMS) beneficiaries.
In a notification letter mailed to the impacted individuals, WPS explains that its 2023 investigation into the incident did not find “any evidence that an unauthorized party obtained copies of files that were within the WPS MOVEit application”.
A second investigation, launched in May 2024 with assistance from a third-party cybersecurity firm, discovered that files were indeed stolen from WPS’s MOVEit file transfer system, and that some of these files included personal information.
The compromised information, WPS says, includes names, addresses, dates of birth, Social Security numbers, gender, hospital account number, dates of service, and Medicare beneficiary identifier or health insurance claim number.
“CMS and WPS are not aware of any reports of identity fraud or improper use of your Personal Information as a direct result of this incident,” WPS’s notification letter reads. Medicare cards with new numbers will be issued where Medicare beneficiary identifiers were compromised.
The insurer is providing the affected individuals with one year of credit monitoring and identity protection services and encourages them to remain vigilant of fraud attempts.
Related: 500k Impacted by Texas Dow Employees Credit Union Data Breach
Related: Avis Data Breach Impacts 300,000 Car Rental Customers
Related: Every “Thing” Everywhere All at Once
Related: Home Depot Agrees to $17.5 Million Settlement With States Over 2014 Data Breach
