MAC Data Breach Notification
In a press release issued by the Centers for Medicare & Medicaid Services (CMS), Wisconsin Physicians Service Insurance Corporation (WPS), the Medicare Administrative Contractor (MAC) for Iowa, Kansas, Missouri, Nebraska, Indiana, and Michigan was involved in a data breach that exposed patients’ protected health information (PHI) involving MOVEit software, a third-party application used by WPS for file transfers in providing Medicare services. This breach potentially affects the PHI of approximately 946,801 current Medicare beneficiaries, as well as some individuals who received healthcare services from providers audited by CMS. Notifications are being mailed to those affected, while a substitute notice will be posted for individuals with outdated contact information.
On July 8, 2024, WPS notified CMS about a cybersecurity incident involving MOVEit, which compromised files containing PHI and other personal data from May 27 to May 31, 2023. Although there are no reports of identity fraud, WPS is informing affected individuals about the incident and providing resources. The compromised information may include names, social security numbers, dates of birth, addresses and health-related identifiers. A vulnerability in MOVEit was discovered on May 31, 2023, and a patch was released. Initial investigations found no unauthorized access, but a later review revealed that some files with personal information had been copied before the patch was applied.
In response to this incident, CMS has offered beneficiary resources including enrolling in the free 12-month use of Experian Identity Protection Monitoring Services. CMS also recommends beneficiaries obtaining one free credit report annually from each of the three major credit reporting companies, reviewing credit reports for unauthorized accounts or errors, and reporting any suspicious activity to local law enforcement and the Federal Trade Commission (FTC).
CMS has not received any reports of identity fraud linked to this incident, specifically with Medicare Beneficiary Identifiers (MBIs). Beneficiaries are recommended to continue using their existing cards. New Medicare cards will be issued to those who may have been affected. For further questions, contact the Experian response line at 833-931-5700 or call 1-800-MEDICARE for general inquiries.
