Medicare data breach bared info of nearly 1M people

The personal information of nearly 1 million Medicare beneficiaries may have been exposed in a data breach last year, when an unauthorized third party accessed a file transfer system used to handle medical claims.

Why it matters: It was part of a pattern in which hackers target vulnerabilities in outside vendors' systems — in this case, the popular file-transfer program MOVEit — and use them to steal customer information.

Driving the news: The Centers for Medicare and Medicaid Services said it is notifying 946,801 beneficiaries in Wisconsin that their names, Social Security numbers, hospital account numbers, and insurance claim information could have been stolen between May 27 and May 31, 2023, before the flaw was discovered and patched.

• CMS and its contractor, the Wisconsin Physicians Service Insurance Corp., said they're not aware of any reports of identity fraud or improper use of the personal information. But they're offering beneficiaries 12 months of free credit monitoring and other identity protection services.
• Those whose Medicare Beneficiary Identifier numbers were affected will get new Medicare cards with new numbers.
• WPS is one of many organizations in the U.S. that have been hit by the MOVEit vulnerability, which allowed intruders to bypass an authentication process that enables encrypted file transfers, per Axios' Sam Sabin.

What's next: CMS said it's continuing to investigate the breach with law enforcement and cybersecurity consultants.