Medicare beneficiaries alerted to contractor data breach 

A May data breach involving MOVEit Transfer software on Medicare contractor Maximus Federal Services’ corporate network may have exposed an estimated 612,000 Medicare beneficiaries’ personally identifiable information and/or protected health information, the Centers for Medicare & Medicaid Services announced July 28. CMS and Maximus are sending letters to affected individuals, who can obtain a free credit report. Those whose Medicare beneficiary number was affected also will receive a new Medicare card.
 
John Riggi, AHA’s national advisor for cybersecurity and risk, said, “The compromise of the MOVEit secure file transfer has been attributed to the Russian ransomware gang known as Clop and has struck multiple government and private-sector organizations, including health care organizations. These attacks demonstrate our cyber adversaries strategic targeting of those third-party applications and services that provide the broadest access to networks and sensitive data. As a result, we should identify and apply enhanced security and monitoring controls to these systems. These attacks also demonstrate that no organization is immune from data breaches, and the enormous complexity in managing third- and fourth-party cyber risk. We look forward to continuing to work with the federal government in the exchange of cyberthreat intelligence and risk mitigation practices to help defend against our common cyber adversaries.”