ENKR

Maximus MOVEit data theft

Add to my breach check

Made public · 8,000,000 people

What leaked10

Hard to replace

  • Driver's licence number
  • Health insurance or Medicare number
  • Mobile number
  • Home or delivery address
  • Email address
  • Other profile data

Permanent

  • Health information
  • Social Security number
  • Date of birth
  • Full name
  • Health informationmedical history, conditions, diagnoses, treatments, providers and prescriptions
  • Social Security numberSSN or individual taxpayer identification number
  • Driver's licence numberdriver's licence or state ID number
  • Health insurance or Medicare numberMedicare Beneficiary Identifier or Health Insurance Claim Number; CMS is issuing new Medicare cards where the Medicare number was involved
  • Mobile numbertelephone or fax number
  • Other profile datahealth insurance claims, policy and enrollment information

To-dos13 · about 3 h 30 min in all

  1. Freeze your credit at Equifax, Experian and TransUnionabout 30 minfreeStops: credit in your name (opens in a new tab)
  2. Get an IRS Identity Protection PINabout 20 minStops: tax refund fraud (opens in a new tab)
  3. Turn on instant transaction alertsabout 5 minHelps you notice: bank account fraud, scam calls
  4. Place a fraud alert on your credit reportsabout 10 minfreeLimits harm from: credit in your name (opens in a new tab)
  5. Check your credit reports every week, freeabout 20 minfreeHelps you notice: credit in your name (opens in a new tab)
8 more
  1. Do nowIf threatened: do not pay, keep the messages, report it to the policeabout 30 minfreeLimits harm from: extortion
  2. This weekFreeze your NCTUE phone and utility fileabout 10 minfreeLimits harm from: phone or utility account (opens in a new tab)
  3. When convenientKnow the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: phishing messages, scam calls
  4. When convenientTurn on your carrier's port-out lockabout 5 minLimits harm from: SIM swap
  5. When convenientTurn on your carrier's SIM-change lockabout 5 minLimits harm from: SIM swap
  6. When convenientCheck your health insurance statements for care you did not getabout 15 minHelps you notice: medical care in your name (opens in a new tab)
  7. When convenientRemove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home
  8. When convenientUse an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: SMS code theft

What happened next9 events

  1. Undetected 2 events3 days · show events
  2. Response 4 eventsNo individual notice on record · show events
  3. Remedy 1 eventOngoing · show events
  4. PenaltyNone on record
  5. Disputes 2 eventsDismissed · show events
  1. Order dismissing this member case of the MOVEit MDL
  2. Class action filed in the Eastern District of Virginia, later transferred to the MOVEit MDL in Massachusetts
  3. Offered 24 months of free Experian credit monitoring, and new Medicare cards and numbers where the Medicare number was involved
  4. Form 8-K: files with SSNs, health and other personal data of at least 8 to 11 million people; free credit monitoring to be offered
  5. CMS and Maximus began notifying about 612,000 Medicare beneficiaries
4 more
  1. Notified CMS
  2. Took MOVEit offline, applied patches and notified law enforcement
  3. Detected unusual activity in its MOVEit application and stopped all use of it early on May 31, 2023
  4. Intrusion began
Company
Maximus
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
8,000,000 people · at least 8 to 11 million; Maximus July 26, 2023, including about 612,000 Medicare beneficiaries · CMS

Sources