CMS portal breach exposes 75,000 individuals' records

CMS says it's working to restore the breached portal and that the incident doesn't affect the operation of HealthCare.gov or open enrollment.

An online portal run by the Centers for Medicare and Medicaid Services experienced a breach last week, giving hackers access to 75,000 people’s files, the agency announced on Friday.

The breached portal is one used by health insurance agents and brokers assisting people with direct enrollment in the government’s Federally Facilitated Exchanges (FFE). CMS did not say what kind of information the exposed records contain or whether they belong to agents and brokers or insurance-seekers.

“While this is a small fraction of consumer records present on the FFE, any breach of our system is unacceptable,” the agency said.

CMS said it began investigating “anomalous system activity” on Saturday, Oct. 13 and declared a breach the following Tuesday. The agency did not say why it waited until Friday to publicly disclose the breach.

CMS, an agency within the Department of Health and Human Services, did not respond to a request for comment.

The agency said that it disabled the portal used by agents and brokers “out of an abundance of caution” and is working to restore it within a week. It also said it deactivated accounts linked to the suspicious activity.

“It is important to note that CMS is in the beginning stages of the assessment of this breach. This is an evolving situation and we will continue to provide additional information,” the agency said in a press release.

The breach does not affect the operation of HealthCare.gov and open enrollment, CMS administrator Seema Verma said in a statement.

“Our number one priority is the safety and security of the Americans we serve.” Verma said. “We are working to identify the individuals potentially impacted as quickly as possible so that we can notify them and provide resources such as credit protection.”

UPDATE, Oct. 26, 2018 at 10:50 a.m. EDT: 

CMS sent out a statement Friday saying that the agent and broker direct enrollment portal for FFE is back online and that it “has worked around the clock to implement new security measures to protect consumer information.”

The agency also said it “can now confirm that no banking, federal tax information (FTI), or protected health information (PHI) was exposed during the breach.”

CMS said that people affected by the breach will be able to apply for free credit protection services once the agency finishes assessing what information was accessed.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure