US gov contractor says MOVEit hackers accessed Medicare, Medicaid health data of 'at least' 8 m

 U.S. government services contracting giant Maximus has confirmed that hackers exploiting a vulnerability in MOVEit Transfer accessed the protected health information of as many as 11 million individuals.

Virginia-based Maximus contracts with federal, state and local governments to manage and administer government-sponsored programs, such as Medicaid, Medicare, healthcare reform and welfare-to-work.

In an 8-K filing on Wednesday, Maximus confirmed that the personal information of a “significant number” of individuals was accessed by hackers exploiting a zero-day vulnerability in MOVEit Transfer, which the organization uses to “share data with government customers pertaining to individuals who participate in various government programs.”

While Maximus hasn’t yet been able to confirm the exact number of individuals impacted — something the company expects to take "several more weeks" — the organization said it believes hackers accessed the personal data, including Social Security numbers and protected health information, of “at least” 8 to 11 million individuals. If the latter, this would make the breach the largest breach of healthcare data this year — and the most significant data breach reported as a result of the MOVEit mass-hacks.

Maximus has not confirmed which specific types of health data were accessed and has not responded to TechCrunch's questions. In its 8-K filing, the company said it began notifying impacted customers and federal and state regulators, adding that it expects the security incident to cost approximately $15 million to investigate and remediate.

Clop, the Russia-linked data extortion group responsible for the MOVEit mass-hacks, claims to have stolen 169 gigabytes of data from Maximus, which it has not yet published.

Maximus is one of just hundreds of organizations impacted by the MOVEit Transfer hacks to appear on Clop’s dark web leak site. This week alone, the ransomware group added a number of new victims, including accountancy giant Deloitte, and global sports betting provider Flutter, which owns Fox Bets and Poker Stars.

https://www.yahoo.com/entertainment/us-government-contractor-says-moveit-121050396.html