www.cms.gov
Open in
urlscan Pro
2a02:26f0:1700:384::28a
Public Scan
Submitted URL: https://www.cms.gov/newsroom/press-releases/cms-responding-data-breach-contractor#:~:text=Maximus%20is%20among%20the...
Effective URL: https://www.cms.gov/newsroom/press-releases/cms-responding-data-breach-contractor
Submission: On September 07 via manual from US — Scanned from DE
Effective URL: https://www.cms.gov/newsroom/press-releases/cms-responding-data-breach-contractor
Submission: On September 07 via manual from US — Scanned from DE
Form analysis 1 forms found in the DOM
GET /newsroom/search
<form action="/newsroom/search" method="get" id="views-exposed-form-newsroom-of-acquia-search-page" accept-charset="UTF-8" data-once="search-language-select">
<div class="search-box-container" style="display:none">
<main role="main">
<div class="clearfix">
<div class="search-dropdown-container">
<label class="ds-u-visibility--screen-reader" for="select-search-language">Select search language:</label>
<div class="search-language desktop"><!-- TODO: hide this in mobile view -->
<select id="select-search-language">
<option value="en" class="full-language">English</option>
<option value="es" class="full-language">Español</option>
<option value="en" class="abbr-language">EN</option>
<option value="es" class="abbr-language">ES</option>
</select>
</div>
<div class="js-form-item form-item js-form-type-search-api-autocomplete form-type-search-api-autocomplete js-form-item-search form-item-search">
<label for="edit-search">Search newsroom articles</label>
<input placeholder="Search newsroom articles" aria-label="Search newsroom articles" aria-expanded="false" role="combobox" type="text" data-drupal-selector="edit-search" data-search-api-autocomplete-search="newsroom_of_acquia_search"
class="form-autocomplete form-text ui-autocomplete-input" data-autocomplete-path="/search_api_autocomplete/newsroom_of_acquia_search?display=page&&filter=search" id="edit-search" name="search" value="" size="30" maxlength="128"
data-once="autocomplete search-api-autocomplete" autocomplete="off">
</div>
<div class="js-form-item form-item js-form-type-select form-type-select js-form-item-search-api-language form-item-search-api-language form-no-label">
<select data-drupal-selector="edit-search-api-language" id="edit-search-api-language" name="search_api_language" class="form-select" title="Language selector">
<option value="All">- Any -</option>
<option value="***LANGUAGE_site_default***">Site's default language (English)</option>
<option value="***LANGUAGE_language_interface***">Interface text language selected for page</option>
<option value="en" selected="selected">English</option>
<option value="es">Spanish</option>
<option value="und">Not specified</option>
<option value="zxx">Not applicable</option>
</select>
</div>
<fieldset data-drupal-selector="edit-field-date-wrapper" id="edit-field-date-wrapper" class="js-form-item form-item js-form-wrapper form-wrapper">
<legend>
<span class="fieldset-legend">Date</span>
</legend>
<div class="fieldset-wrapper">
<div class="js-form-item form-item js-form-type-textfield form-type-textfield js-form-item-field-date-min form-item-field-date-min">
<label for="edit-field-date-min">Min</label>
<input data-drupal-selector="edit-field-date-min" type="text" id="edit-field-date-min" name="field_date[min]" value="" size="30" maxlength="128" class="form-text">
</div>
<div class="js-form-item form-item js-form-type-textfield form-type-textfield js-form-item-field-date-max form-item-field-date-max">
<label for="edit-field-date-max">Max</label>
<input data-drupal-selector="edit-field-date-max" type="text" id="edit-field-date-max" name="field_date[max]" value="" size="30" maxlength="128" class="form-text">
</div>
</div>
</fieldset>
<div class="js-form-item form-item js-form-type-select form-type-select js-form-item-sort-by form-item-sort-by">
<label for="edit-sort-by">Sort by</label>
<select data-drupal-selector="edit-sort-by" id="edit-sort-by" name="sort_by" class="form-select">
<option value="field_date" selected="selected">Newest First</option>
<option value="search_api_relevance">Best Match</option>
</select>
</div>
<div class="js-form-item form-item js-form-type-select form-type-select js-form-item-sort-order form-item-sort-order">
<label for="edit-sort-order">Order</label>
<select data-drupal-selector="edit-sort-order" id="edit-sort-order" name="sort_order" class="form-select">
<option value="ASC">Asc</option>
<option value="DESC" selected="selected">Desc</option>
</select>
</div>
<div class="js-form-item form-item js-form-type-select form-type-select js-form-item-items-per-page form-item-items-per-page">
<label for="edit-items-per-page">Items per page</label>
<select data-drupal-selector="edit-items-per-page" id="edit-items-per-page" name="items_per_page" class="form-select">
<option value="10" selected="selected">10</option>
<option value="20">20</option>
<option value="30">30</option>
<option value="40">40</option>
<option value="50">50</option>
<option value="All">View All</option>
</select>
</div>
<div data-drupal-selector="edit-actions" class="form-actions js-form-wrapper form-wrapper" id="edit-actions"><input data-drupal-selector="edit-submit-newsroom-of-acquia-search" type="submit" id="edit-submit-newsroom-of-acquia-search"
value="SEARCH" class="button js-form-submit form-submit" data-once="searchMatch">
</div>
</div>
</div>
</main>
</div>
</form>Text Content
Skip to main content An official website of the United States government Here’s how you know Here’s how you know The .gov means it’s official. Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you’re on a federal government site. The site is secure. The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely. Resource Navigation * Press Kit * CMSData * Contact * Blog * Podcast * About Us * Newsroom * Data & Research opens in new window Toggle Mobile Search Close Search Centers for Medicare & Medicaid Services MAIN HEADER * About Us * Newsroom * Data & Research Newsroom NEWSROOM_NAVIGATION * Press Kit * CMSData * Contact * Blog * Podcast Search Select search language: English Español EN ES Search newsroom articles - Any -Site's default language (English)Interface text language selected for pageEnglishSpanishNot specifiedNot applicable Date Min Max Sort by Newest FirstBest Match Order AscDesc Items per page 1020304050View All PRESS RELEASE CMS RESPONDING TO DATA BREACH AT CONTRACTOR Jul 28, 2023 * Data * Safety Share opens in new window opens in new window opens in new window CMS NOTIFYING POTENTIALLY INVOLVED BENEFICIARIES AND PROVIDING INFORMATION ON FREE CREDIT MONITORING The Department of Health and Human Services (HHS) and the Centers for Medicare & Medicaid Services (CMS) have responded to a May 2023 data breach in Progress Software’s MOVEit Transfer software on the corporate network of Maximus Federal Services, Inc. (Maximus), a contractor to the Medicare program, that involved Medicare beneficiaries’ personally identifiable information (PII) and/or protected health information (PHI). No HHS or CMS systems were impacted. Maximus is among the many organizations in the United States that have been impacted by the MOVEit vulnerability. This week, CMS and Maximus are sending letters to individuals who may have been impacted notifying them of the breach, and explaining actions being taken in response. CMS estimates the MOVEit breach impacted approximately 612,000 current Medicare beneficiaries. CMS and Maximus are notifying Medicare beneficiaries whose PII and/or PHI may have been exposed that they are being offered free-of-charge credit monitoring services for 24 months. This notification also contains information about how impacted individuals can obtain a free credit report, and, for those beneficiaries whose Medicare Beneficiary Identifier number may have been impacted, information on receiving a new Medicare card with a new number. Below please find a sample of the letter being sent to those who are potentially affected: Dear <<Name 1>> The Centers for Medicare & Medicaid Services (CMS), the federal agency that manages the Medicare program, and Maximus Federal Services, Inc. (Maximus), are writing to inform you of an incident involving your personal information related to services provided by Maximus. Maximus is a CMS contractor that provides appeals services in support of the Medicare program. The incident involved a security vulnerability in the MOVEit software, a third-party application which allows for the transfer of files during the Medicare appeals process. Maximus is among the many organizations in the United States that have been impacted by the MOVEit vulnerability. We are sending you this letter so that you can understand more about this incident, how we are addressing it, and additional steps you can take to further protect your privacy. We are providing information with this notice on free credit monitoring services and, if your Medicare Beneficiary Identifier (MBI) was impacted, will be giving you a new Medicare card with a new Medicare Number. This does not impact your current Medicare benefits or coverage. What Happened? Our understanding is as follows: On May 30, 2023, Maximus detected unusual activity in its MOVEit application. Maximus began to investigate and stopped all use of the MOVEit application early on May 31, 2023. Later that same day, the third-party application provider, Progress Software Corporation, announced that a vulnerability in its MOVEit software had allowed an unauthorized party to gain access to files across many organizations in both the government and private sectors. Maximus notified CMS of the incident on June 2, 2023. To date, the ongoing investigation indicates that on approximately May 27 through 31, 2023, the unauthorized party obtained copies of files that were saved in the Maximus MOVEit application, but that no CMS system has been compromised. After notifying CMS, Maximus then began to analyze the files to determine which data had been affected. As part of that analysis, it was determined that those files contained some of your personal information. What Information Was Involved? We have determined that your personal and Medicare information was involved in this incident. This information may have included the following: * Name * Social Security Number or Individual Taxpayer Identification Number * Date of Birth * Mailing Address * Telephone Number, Fax Number, & Email Address * Medicare Beneficiary Identifier (MBI) or Health Insurance Claim Number (HICN) * Driver’s License Number and State Identification Number * Medical History/Notes (including medical record/account numbers, conditions, diagnoses, dates of service, images, treatments, etc.) * Healthcare Provider and Prescription Information * Health Insurance Claims and Policy/Subscriber Information * Health Benefits & Enrollment Information What Are We Doing? When the incident was discovered, Maximus began an investigation, took the MOVEit application offline, applied MOVEit software patches, and notified law enforcement. CMS is continuing to investigate this incident in coordination with Maximus and will take all appropriate actions to safeguard the information entrusted to CMS. What Can You Do? 1. Enroll in Experian Identity and Credit Monitoring Services Maximus is offering a complimentary 24 months of credit monitoring and other services from Experian at no cost to you. You do not need to use your credit card or any other form of payment to enroll in the service. Please see Attachment #1 for information on how to utilize your free Experian Services. 2. Obtain a Free Credit Report Under federal law, you are entitled to one free credit report every 12 months from each of the three major nationwide credit reporting companies listed above. Call 1-877-322-8228 or request your free credit reports online at www.annualcreditreport.com. When you receive your credit reports, review them for problems. Identify any accounts you didn’t open or inquiries from creditors that you did not authorize. Verify all information is correct. If you have questions or notice incorrect information, contact the credit reporting company. Even if you don’t find any suspicious activity on your initial credit reports, the Federal Trade Commission (FTC) recommends that you still check your credit reports periodically. Checking your credit report periodically can help you spot problems and address them quickly. If you find suspicious activity on your credit reports or have reason to believe your information is being misused, call your local law enforcement agency and file a police report. Be sure to obtain a copy of the police report, as many creditors will want the information it contains to absolve you of the fraudulent debts. You may also file a complaint with the FTC by contacting them on the web at www.ftc.gov/idtheft, by phone at 1-877-IDTHEFT (1-877-438-4338), or by mail at Federal Trade Commission, Consumer Response Center, 600 Pennsylvania Avenue, NW, Washington, DC 20580. Your complaint will be added to the FTC’s Identity Theft Data Clearinghouse, where it will be accessible to law enforcement for their investigations. In addition, you may obtain information from the FTC about fraud alerts and security freezes. Please see Attachment #2 for additional steps you can take to protect your information. 3. Continue to Use Your Existing Medicare Card At this time, we are not aware of any reports of identity fraud or improper use of your information as a direct result of this incident. However, if your MBI was impacted, a new Medicare card with a new number will be issued to you. CMS will mail the new card to your address in the coming weeks. In the meantime, you can continue to use your existing Medicare card. After you get your new card, you should: 1. Follow the instructions in the letter that comes with your new card. 2. Destroy your old Medicare card. 3. Inform your providers that you have a new Medicare Number. For More Information We take the privacy and security of your Medicare information very seriously. CMS and Maximus apologize for the inconvenience this privacy incident might have caused you. If you have any further questions regarding this incident, please call the Experian dedicated and confidential toll-free response line at xxx-xxx-xxxx. This response line is staffed with professionals familiar with this incident who know what you can do to protect against misuse of your information. The response line is available Monday through Friday from 8 am – 10 pm Central, or Saturday and Sunday from 10 am – 7 pm Central (excluding major U.S. holidays). You can also call 1-800-MEDICARE (1-800-633-4227) with any general questions or concerns about Medicare. ### Get CMS news at cms.gov/newsroom, sign up for CMS news via email and follow CMS on Twitter @CMSgov * Previous Press Release * Next Press Release RELATED RELEASES * For the First Time, HHS Is Making Ownership Data for All Medicare-Certified Hospice and Home Health Agencies Publicly Available Apr 20, 2023 * Biden-Harris Administration Continues Unprecedented Efforts to Increase Ownership Transparency in Health Care Settings Dec 20, 2022 * Advancing Interoperability and Improving Prior Authorization Processes Proposed Rule CMS-0057-P: Fact Sheet Dec 06, 2022 * CMS Publishes Program Year 2021 Open Payments Data on Health Care Providers Jun 30, 2022 * CMS Makes Nursing Home COVID-19 Booster Vaccination Data Available Online, Increasing Transparency for Consumers Feb 09, 2022 CONTACT US CMS News and Media Group Catherine Howden, Director Media Inquiries Form 202-690-6145 GET EMAIL UPDATES Sign up to get the latest information about your choice of CMS topics in your inbox. Also, you can decide how often you want to get updates. SIGN UPopens in new window CMS & HHS WEBSITES * Medicare.govopens in new window * Medicaid.govopens in new window * InsureKidsNow.govopens in new window * HealthCare.govopens in new window * HHS.govopens in new window HELPFUL LINKS * Acronyms * Archive * Contacts * Glossary * Privacy policy * Privacy settings RSS FEEDS * NewsroomRSS Feeds * BlogRSS Feeds * PodcastRSS Feeds opens in new window opens in new window A federal government website managed and paid for by the U.S. Centers for Medicare & Medicaid Services. 7500 Security Boulevard, Baltimore, MD 21244 Facebook, opens in new window Twitter, opens in new window Linked in, opens in new window TOOLS * Web policiesopens in new window * Plain languageopens in new window * No Fear Actopens in new window * Freedom of Information Actopens in new window * Inspector Generalopens in new window Feedback