More than 3 million Medicare users have had their sensitive information leaked following a major cyberattack on the MOVEit file transfer system. The breach, affecting people across multiple states, came to light last year and has now been confirmed to include 3.1 million individuals, as new data reveals.
The Centers for Medicare & Medicaid Services (CMS) and Wisconsin Physicians Service Insurance Corporation (WPS) disclosed the breach, highlighting that nearly 1 million people will receive notifications explaining the scope of the leaked data. Compromised information includes names, Social Security numbers, birthdates, addresses, and health insurance details.
While CMS initially reported around 946,000 people affected, the number has since surged to 3.1 million, including 1.9 million non-Medicare individuals and 1.2 million Medicare beneficiaries. Of these, 247,000 are deceased.
WPS, responsible for processing Medicare claims in six states, confirmed that the breach occurred in May 2023 but only discovered the full extent in 2024. Hackers exploited a vulnerability in the MOVEit software before a patch was applied. CMS will issue new Medicare cards to affected individuals and has advised them to monitor accounts for fraudulent activity.
The breach is part of a larger campaign targeting the MOVEit system, believed to be one of the largest data breaches in history. Nearly 96 million records were stolen, linked to the Clop ransomware gang.
CMS continues to work with law enforcement, while urging victims to take advantage of the offered credit monitoring services.
This incident highlights the growing threat posed by cybercriminals, particularly in targeting sensitive health data.
