US government agency confirms it was hit by major ransomware attack

IT
(Image credit: Shutterstock / carlos castilla)

It’s been more than a year since news of the MOVEit breach first emerged, and we’re still getting information on new victims.

The latest firm to add to the list is The Centers for Medicare & Medicaid Services (CMS), a US federal agency within the U.S. Department of Health and Human Services (HHS) that oversees the nation’s major healthcare programs, including Medicare, Medicaid, and the Children’s Health Insurance Program (CHIP), and so plays a critical role in administering health coverage to millions of Americans.

The agency has now confirmed suffering a data breach incident as a result of the MOVEit vulnerability that saw sensitive data belonging to 3,112,815 people stolen. Many of those are either deceased, or not Medicare beneficiaries, since CMS only notified roughly 950,000 people.

Personally identifiable information stolen

In the breach notification letter, which was also sent to the HHS, CMS said crooks took people’s names, social security numbers, individual taxpayer identification numbers, birth dates, mailing addresses, gender data, hospital account number, dates of service, Medicare beneficiary identifiers, and health insurance claim numbers.

This is more than enough data to steal identities or commence phishing attacks that could result in even more disruptive attacks. Those who suspect their data has been stolen may want to consider our guide to the best identity theft protection.

CMS explained that it patched its MOVEit Transfer instance in early June last year, and assumed it would be safe. However, by the time the patch was installed, Cl0p operatives had already extracted all of the information they needed, and CMS only realized that in May this year.

Last year, ransomware operators Cl0p found a flaw in the managed file transfer service and used it to steal sensitive data from hundreds of organizations around the world, leading to the SEC launching a full investigation.

Via BleepingComputer

More from TechRadar Pro

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
ID theft
Over a million patients potentially hit after another US healthcare provider hit by cyberattack
Lock on Laptop Screen
United Healthcare data breach may have affected 190 million Americans
security
Ransomware gangs allegedly hit two major US healthcare firms, 300,000 patients have data stolen
healthcare
Over a million clinical records exposed in data breach
ransomware avast
The biggest addiction treatment provider in the US says it was hit by data breach
Data leak
US utility giant says MOVEit hack exposed stolen data
Latest in Security
Isometric demonstrating multi-factor authentication using a mobile device.
NCSC gets influencers to sing the praises of 2FA
Sam Altman and OpenAI
OpenAI is upping its bug bounty rewards as security worries rise
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Dangerous new CoffeeLoader malware executes on your GPU to get past security tools
China
Notorious Chinese hackers FamousSparrow allegedly target US financial firms
A digital representation of a lock
NYU website defaced as hacker leaks info on a million students
NHS
NHS IT supplier hit with major fine following ransomware attack
Latest in News
cheap Nintendo Switch game deals sales
Nintendo didn't anticipate that Mario Kart 8 Deluxe was 'going to be the juggernaut' for the Nintendo Switch when it was ported to the console, according to former employees
Three angles of the Apple MacBook Air 15-inch M4 laptop above a desk
Apple MacBook Air 15-inch (M4) review roundup – should you buy Apple's new lightweight laptop?
Witchbrook
Witchbrook, the life-sim I've been waiting years for, finally has a release window and it's sooner than you think
Amazon Echo Smart Speaker
Amazon is experimenting with renaming Echo speakers to Alexa speakers, and it's about time
Shigeru Miyamoto presents Nintendo Today app
Nintendo Today smartphone app is out now on iOS and Android devices – and here's what it does
iPhone 13 mini
The iPhone mini won't be returning, according to rumors – and you think that's a mistake