MOVEit Transfer breach impacted more than 1 million MESVision customers

California based eye care provider MESVision said the information of more than 1.1 million patients was compromised after cyber criminals exploited a zero-day vulnerability in Progress Software’s MOVEit Transfer web application.

 

In a data breach notification filed with the Attorney General’s office of Maine, Medical Eye Services (MESVision) said that it used Progress Software’s MOVEit Transfer web application to send and receive files securely and was impacted after cyber criminals exploited a zero-day vulnerability in the application earlier this year.

 

After being notified by Progress Software, the manufacturer of MOVEit software, MESVision immediately took the affected server offline and launched an internal investigation with assistance from third party cyber security experts to understand the scope of the incident.

 

“It was determined that the unauthorised individual exfiltrated information from the server on May 28, 2023, and May 31, 2023,” the company said.

 

The affected data belonged to patients who enrolled in vision benefit plans managed by MESVision. The company’s investigation revealed that the compromised data included customers’ names and other personal identifiers along with Social Security Numbers. The company’s filing with the regulator also revealed that at least 346,828 individuals were impacted by the incident.

 

On November 17, Blue Shield California, one of MESVision’s clients, filed a notice of data breach with the state regulator stating that one of its vendors suffered a significant data breach using the MOVEit Transfer web application.  According to the filing, at least 664,824 individuals had their names, Social Security Numbers, and other personal identifiers compromised in the data security incident.

 

In a recent filing with the Office of the Maine Attorney General, MESVision added another 2,743 individuals to the list of affected individuals. Based on the three filings with the state regulator, at least 1,014,395 individuals have been impacted by the data security incident so far.

 

“MESVision has rebuilt the MOVEit system in accordance with vendor requirements and with our gold standard build requirements. Before reactivating the system, we took a number of technical measures to validate the security protections put in place,” the healthcare provider said.

 

MESVision has urged all affected individuals to remain vigilant and keep an eye out for any suspicious activities in their credit report. It is also providing a year of complimentary identity monitoring services, including credit monitoring, fraud consultation, and identity theft restoration via Kroll to all affected individuals.