Scroll Top

HHS informs congress of MOVEit hacks, over 100,000 people affected


HHS informs congress of MOVEit hacks, over 100,000 people affected
U.S. Department of Health and Human Services reports data breach through Third-Party vendors exploiting MOVEit flaw

The U.S. Department of Health and Human Services (HHS) has revealed to Congress that the personal information of over 100,000 individuals has been compromised in hacking incidents involving HHS contractors. The breaches are linked to the exploitation of a vulnerability in MOVEit, a managed file transfer software product.

According to an HHS official, the department notified Congress about the breach on Tuesday. While HHS systems and networks remained uncompromised, attackers gained access to HHS data by exploiting the vulnerability present in the MOVEit software used by third-party vendors.

The HHS official stated that the department is taking all necessary measures to respond to the incident. In compliance with the Federal Information Security Modernization Act, HHS will provide Congress with additional information as the investigation progresses.

Under federal regulations, government agencies must notify Congress within seven days of identifying “major incidents” compromising the personally identifiable information of 100,000 or more individuals.

Bloomberg was the first to report the HHS notification to Congress on Thursday.

HHS has joined a growing list of U.S. federal government entities that have experienced significant breaches related to the MOVEit vulnerability. The Clop ransomware group has actively exploited this vulnerability for several months, targeting agencies such as the departments of Energy and Agriculture, as well as the Office of Personnel Management. State agencies, including Maryland’s Department of Health and Human Services, and the departments of education in Minnesota and New York City, were also affected.

The healthcare sector has not been spared from this campaign, with Nova Scotia Health in Canada reporting a hacking incident in June that affected the personal information of 100,000 employees.

Clop’s data leak site has revealed additional victims, including healthcare software firm Vitality Group International, Talcott Resolution Life Insurance Co., and various universities such as Georgia, Johns Hopkins, Missouri, Rochester, and Southern Illinois.

On June 2, HHS issued an alert for the healthcare and public health sector, warning of potential compromises related to MOVEit.

HHS’ Health Sector Cybersecurity Coordination Center emphasized the risks associated with the vulnerability, including the exposure of sensitive information like medical records, bank records, Social Security numbers, and addresses. The targeted organizations could also face extortion by financially motivated threat groups, HHS HC3 warned.

The hacking campaign gained attention after the Russian-speaking cybercrime group Clop began exploiting a previously unknown vulnerability.

Related Posts

Leave a comment

You must be logged in to post a comment.
Privacy Preferences
When you visit our website, it may store information through your browser from specific services, usually in form of cookies. Here you can change your privacy preferences. Please note that blocking some types of cookies may impact your experience on our website and the services we offer.