CMS notifies nearly 950,000 individuals of data breach linked to MOVEit vulnerability

In a press release, the Centers for Medicare & Medicaid Services (CMS) announced that it and its contractor, Wisconsin Physicians Service Insurance Corporation (WPS), are notifying nearly 950,000 individuals whose personal and health information may have been compromised. The breach is connected to a vulnerability in the MOVEit software, a third-party file transfer application used by WPS to provide Medicare administrative services.

The breach was discovered between May 27 and May 31, 2023, when unauthorized third parties exploited a vulnerability in MOVEit, allowing access to sensitive information. The data exposed includes personally identifiable information (PII) of Medicare beneficiaries, particularly information collected for managing Medicare claims and conducting CMS audits of healthcare providers. This breach could potentially impact individuals not enrolled in Medicare but who visited providers under CMS audits.

WPS informed CMS of the breach on July 8, 2023, and an investigation concluded that no files had been copied. However, in May 2024, new evidence emerged indicating that some files had been exfiltrated before the vulnerability was patched, revealing that personal data had been compromised.

Despite the breach, CMS and WPS stated that, to date, there have been no reports of identity theft or fraudulent use of the stolen data. Notifications are being sent to 946,801 affected individuals, with CMS offering further guidance and support.

This breach marks the latest in a series of vulnerabilities related to MOVEit software vulnerabilities, which government agencies and regulated industries widely use to handle sensitive information. Notably, a similar breach in 2022 affected approximately 612,000 Medicare beneficiaries through Maximus Federal Services, a CMS contractor, with the potential total impact increasing to 942,000 people.