Medicaid recipients in Texas are the latest victims of a massive data breach at third-party file transfer platform MOVEit, Massachusetts Chan College of Medicine announced Thursday.
The Texas Health and Human Services Commission previously used the MOVEit platform to transfer files related to services provided by UMass Chan. The Texas Department of State Health Services serves as the state arm of the joint state-federal Medicaid program.
Hackers breached MOVEit in late May, and files containing the names and Social Security numbers of some Texans who received HHSC services were identified on August 17. HHSC was alerted to these findings on the same day, Professor Massachusetts Chan said in a news release.
The release did not say how many people may have been affected by the hack. HHSC spokeswoman Jennifer Ruffkorn said in an email that individuals can call Chan University directly at 855-457-6006 to determine whether they were involved in a breach.
The MOVEit hack affected over 2,500 organizations and over 67 million people. Maximus, a federal contractor that works with Medicaid, is the largest organization affected, with 11 million individuals, according to anti-malware and cybersecurity company Emsisoft. Other organizations include the Louisiana Department of Motor Vehicles, the Colorado Department of Health Policy and Financing, and the Oregon Department of Transportation.
San Antonio news station KENS reported that Maximus, which is also a Texas HHSC contractor, warned some Texans in September that their information was affected by the MOVEit breach. Nearly 88,500 Texans were affected, according to filings with the attorney general's office.
Cyber attacks are becoming increasingly common and indiscriminate. Ransomware group Play recently announced that it had hacked into Dallas County's network and posted some of the stolen information on the dark web. Dallas County officials said Tuesday they are examining the stolen files to determine whether the data contains personal information about employees or residents.
This spring, hackers stole approximately 819,000 files stored in Dallas in a ransomware attack.
Starting September 1, businesses in Texas will be required to notify the attorney general within 30 days of discovering a computer breach involving confidential information of at least 250 people. Previously, state law required him to notify within 60 days of discovering the infringement.
