Maximus Said MOVEit Transfer Hack Compromised Its Customers’ Protected Health Information
A company offering technology services to help US citizens seamlessly access government services, Maximus,said it suffered a data breach as a result of the Clop ransomware group exploiting a zero-day vulnerability in the MOVEit Transfer web application.
In a recent 8-K filing with the Securities and Exchange Commission (SEC), the company said that it used the MOVEit Transfer software for internal and external file-sharing purposes, which includes sharing data with government customers.
After Progress Software, the developer of MOVEit notified Maximus about the security incident where the Clop ransomware gang actively exploited a zero-day vulnerability in the application, the company started an internal investigation to understand the scope of the breach.
“The Company believes that the personal information of a significant number of individuals was accessed by an unauthorised third party by exploiting this MOVEit vulnerability. The Company is cooperating with law enforcement regarding this cyber security incident,” the filing reads.
According to the internal investigation conducted by Maximus with assistance from external legal, forensic, and data analytics experts, the threat actors gained unauthorised access to certain files in its internal network.
After reviewing the nature of the data accessed by the hacker group, Maximus concluded that the files contained sensitive personal information of its clients, including their social security numbers, protected health information, and other personal information.
“Based on the review of impacted files to date, the Company believes those files contain personal information, including social security numbers, protected health information and/or other personal information, of at least 8 to 11 million individuals to whom the Company anticipates providing notice of the incident.
“The Company has been notifying its customers as well as federal and state regulators, and it will provide appropriate notifications to individuals affected by this incident,” Maximus said in the 8-K filing.
Maximus has clarified that the “internal information technology systems of the Company or its customers beyond the MOVEit environment” weren’t affected by the security incident.It also found no “material interruption to the Company’s business operations.”
Maximus will provide complimentary credit monitoring and identity restoration services to all affected individuals who will receive a notice of data breach from the company.
According to reports, the Clop ransomware gang has claimed to be in possession of 169 GB of data stolen from Maximus’ systems but the group hasn’t published the data yet.
Maximus is among more than 500 organisations worldwide that have suffered significant data breaches as a result of the Clop ransomware gang exploiting vulnerabilities in Progress Software’s MOVEit Transfer web application. In fact, according to German cybersecurity research firm KonBriefing, as of June 28, at least 545 organisations have come forward about security incidents resulting from the exploitation of the software, and up to 37.6 million individuals have been impacted by the same.
KonBriefing’s research also confirms that out of the 545 affected organisations, at least 366 are American companies.
