Nearly 1 Million More Medicare Beneficiaries May Be Affected in Year-Old Data Breach

The Centers for Medicare & Medicaid Services (CMS) is notifying almost a million beneficiaries whose personal information may have been compromised in a contractor’s data breach last year.

The contractor, Madison-based Wisconsin Physicians Service Insurance Corp., processes Medicare claims for CMS in six states: Illinois, Iowa, Kansas, Michigan, Missouri and Nebraska. But beneficiaries elsewhere could be affected if they used providers in those states. The notification to 946,801 Medicare beneficiaries comes more than a year after a security vulnerability was discovered in file-transfer software called MOVEit.

Wisconsin Physicians Service collects information such as Medicare and Social Security numbers to manage Medicare claims and audit health care providers. The Medicare beneficiaries’ personally identifiable information was exposed between May 27 and May 31, 2023, but the company patched its MOVEit software and initially thought none of its records had been part of the data breach.

New review unearthed previous copying of records

In May of this year, Wisconsin Physicians Service again reviewed its MOVEit file transfer system with help from a cybersecurity firm, discovering that files had been copied before the patch was put in place. Portions of the files had no personal information, but other parts evaluated July 8 were determined to include information valuable to hackers:

• Name
• Address
• Birth date
• Gender
• Hospital account number
• Medicare or health insurance claim number
• Social Security number or taxpayer identification number

In August 2023, CMS said the MOVEit data breach had affected 612,000 Medicare beneficiaries. Other commercial and government customers worldwide also use the file transfer application.

“The Centers for Medicare & Medicaid Services have issued … multiple notices in July 2023 related to third-party administrators who were users of the MOVEit transfer software,” says James E. Lee, chief victims officer for the San Diego-based Identity Theft Resource Center. “This is the first breach notice related to Wisconsin Physicians Service Insurance Corp., and it too is linked to the MOVEit breach from last year.”

CMS and Wisconsin Physicians Service say they are not aware of reports of identity fraud or improper use of the personal information as a direct result of the breach but are mailing notifications to the Medicare beneficiaries telling them of steps they can take to protect their financial health.