State of Maine says MOVEit breach exposed data on 1.3 million people

The State of Maine disclosed in November 2023 that attackers exploiting a vulnerability in the MOVEit Transfer file transfer software had copied files containing personal information on approximately 1.3 million people. The state said the unauthorized access took place over two days, May 28 and 29, 2023, and that it identified the activity on May 31 and blocked further access.

Around ten state agencies held data in the affected system. The Department of Health and Human Services accounted for the largest share, more than half of the records, and the Department of Education for up to about a third. Smaller volumes came from the Bureau of Motor Vehicles, the Department of Corrections, the Department of Labor, Administrative and Financial Services, Workers' Compensation, Economic and Community Development, and Professional and Financial Regulation.

Exposed fields varied by individual and could include name, date of birth, Social Security number, driver's license or state identification number and taxpayer identification number. For some people medical information and health insurance information were also involved. Not everyone affected lived in the state: TechCrunch reported that 534,194 of those notified were Maine residents.

Maine published a dedicated incident website, opened a telephone helpline and offered two years of credit monitoring and identity theft protection at no cost to anyone whose Social Security number or taxpayer identification number was exposed. The theft formed part of the Clop group's mass campaign against MOVEit users.