Get all your news in one place.
100’s of premium titles.
One app.
Start reading
TechRadar
TechRadar
Sead Fadilpašić

Colorado says millions had their healthcare data stolen after MOVEit breach

Ransomware attack on a computer

The Colorado Department of Health Care Policy & Financing (HCPF) is the latest victim of the MOVEit supply chain attack, with the agency warning that records belonging to millions have been stolen.

As HCFP said in an announcement, its third-party contractor, IBM, used the MOVEit software, through which ransomware threat actors Clop stole sensitive data belonging to four million customers. 

HCPF launched an investigation after it was notified by IBM of the breach, to check what data had been compromised. It found that, "certain HCPF files on the MOVEit application used by IBM were accessed by the unauthorized actor on or about May 28, 2023.”

Plenty of sensitive information

HCPF manages the Health First Colorado (Medicaid) and Child Health Plan Plus programs, as well as supporting low-income families, the elderly, and citizens with disabilities, BleepingComputer reports. 

The data stolen in the attack includes full names, Social Security Numbers, income information, demographic data, birth dates, postal addresses, and other contact information. Medicaid and Medicare ID numbers, as well as health and health insurance data, were also stolen. This is pure identity theft which can later be used for spear phishing, tax fraud, wire fraud, and more. 

To tackle the problem, HPCF said it would provide credit monitoring services via Experian for two years. 

MOVEit is a managed file transfer (MFT) program used by many high-profile organizations to share sensitive data, securely. In late May this year, MOVEit warned of a critical vulnerability discovered in its solution (later tracked as CVE-2023-34362), which could grant threat actors “escalated privileges and potential unauthorized access to the environment.”

Clop said it compromised “hundreds” of organizations, including 1st Source and First National Bankers Bank, Putnam Investments, Landal Greenparks, Shell, Datasite, National Student Clearinghouse, United Healthcare Student Resources, Leggett & Platt, ÖKK, and the University System of Georgia.

Via BleepingComputer

Sign up to read this article
Read news from 100’s of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
One subscription that gives you access to news from hundreds of sites
Already a member? Sign in here
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.