US government agency confirms it was hit by major ransomware attack

News
By published

Cl0p victims are still coming forward

IT
(Image credit: Shutterstock / carlos castilla)

It’s been more than a year since news of the MOVEit breach first emerged, and we’re still getting information on new victims.

The latest firm to add to the list is The Centers for Medicare & Medicaid Services (CMS), a US federal agency within the U.S. Department of Health and Human Services (HHS) that oversees the nation’s major healthcare programs, including Medicare, Medicaid, and the Children’s Health Insurance Program (CHIP), and so plays a critical role in administering health coverage to millions of Americans.

The agency has now confirmed suffering a data breach incident as a result of the MOVEit vulnerability that saw sensitive data belonging to 3,112,815 people stolen. Many of those are either deceased, or not Medicare beneficiaries, since CMS only notified roughly 950,000 people.

Personally identifiable information stolen

In the breach notification letter, which was also sent to the HHS, CMS said crooks took people’s names, social security numbers, individual taxpayer identification numbers, birth dates, mailing addresses, gender data, hospital account number, dates of service, Medicare beneficiary identifiers, and health insurance claim numbers.

This is more than enough data to steal identities or commence phishing attacks that could result in even more disruptive attacks. Those who suspect their data has been stolen may want to consider our guide to the best identity theft protection.

CMS explained that it patched its MOVEit Transfer instance in early June last year, and assumed it would be safe. However, by the time the patch was installed, Cl0p operatives had already extracted all of the information they needed, and CMS only realized that in May this year.

Last year, ransomware operators Cl0p found a flaw in the managed file transfer service and used it to steal sensitive data from hundreds of organizations around the world, leading to the SEC launching a full investigation.

Via BleepingComputer

More from TechRadar Pro

Sead Fadilpašić

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.