Cyber ​​attack on IBM compromised medical information of four million patients

The impact was due to IBM using the MOVEit application to transfer data files from the Colorado Department of Health Policy and Finance.

A recent cyberattack exposed the health data of more than 4 million people, the Colorado Department of Health Policy and Financing has confirmed. This attack, which targeted IBM’s MOVEit file transfer systems, had a significant impact on the security of health information in the United States.

The Colorado Department of Health Policy and Financing (HCPF), which is responsible for administering the state Medicaid program, announced a massive hack on its platform that led to the disclosure of data from over four million patients. According to the notice sent to the victims, the HCPF explained that the impact was due to IBM using the MOVEit application to transfer the HCPF data files.

While this vulnerability did not directly affect Colorado state systems or HCPF, allowed an unauthorized entity to access certain files in the MOVEit application used by IBM.

The leaked information included a wide range of personal and medical data, including full names, dates of birth, addresses, social security numbers, Medicaid and Medicare IDs, income data, clinical and medical records such as lab results, and medications. as well as medical insurance details.

The attack also affected the Missouri Department of Human Services (DSS), although the exact number of victims has not yet been made public. The Missouri DSS, in a statement released last week, said that IBM, as a service provider for the government agency, was compromised in this data breach, which affected information held by the DSS but not the agency’s internal systems.

This incident highlights the growing threat of cyberattacks in the healthcare industry and the need to maintain strong cybersecurity in the networks and systems used to process sensitive medical data. The investigation into the attack is ongoing and additional measures are expected to be taken to prevent future security breaches.