CMS said a MOVEit hack at contractor WPS exposed 946,801 Medicare beneficiaries

The Centers for Medicare & Medicaid Services said in September 2024 that personal information belonging to Medicare beneficiaries had been exposed in the 2023 MOVEit Transfer campaign, through a contractor rather than through CMS systems. Wisconsin Physicians Service Insurance Corporation, which handles Medicare claims administration for CMS, used the Progress Software file transfer tool that the Cl0p ransomware group exploited through a zero day flaw.

Attackers accessed WPS files between 27 and 31 May 2023, shortly before the vendor patch was released. WPS investigated at the time and concluded that no records had been copied. A fresh review begun in May 2024 and carried out with a cybersecurity firm found that files had in fact been taken, and by early July 2024 WPS had identified personal information within them and informed CMS.

CMS and WPS notified 946,801 current Medicare beneficiaries. The exposed fields included names alongside Social Security or individual taxpayer identification numbers, dates of birth, mailing addresses, gender, hospital account numbers, dates of service, and Medicare Beneficiary Identifiers or Health Insurance Claim Numbers. CMS reported 3,112,815 individuals to the federal breach portal on behalf of WPS. It attributed the gap to WPS holding data on people who had died and on many individuals who were not Medicare beneficiaries but whose data WPS collected in the course of its work for CMS. CMS put the total at an estimated 1.9 million non-Medicare individuals and an estimated 1.2 million people with Medicare, of whom about 247,000 are deceased and 946,801 living.

Affected people were offered 12 months of credit monitoring at no cost. CMS said it was not aware of any reports of identity fraud or improper use of the data at the time of the announcement. WPS processes Medicare claims for CMS in Indiana, Iowa, Kansas, Michigan, Missouri and Nebraska.