What should I do if I was affected by this healthcare data breach?

If you were affected, monitor your credit reports and explanation of benefits statements for suspicious activity, take advantage of any free credit monitoring offered, consider freezing your credit, and document any unauthorized use of your health information. You may also be eligible to join a class action lawsuit for compensation.

How do I know if my data was included in this breach?

The breached organization is required by HIPAA to notify affected individuals within 60 days. Check your mail and email for breach notification letters. You can also contact the organization directly to ask if your records were affected. If the breach involved 500+ individuals, it is publicly reported to HHS and listed in their breach portal.

Centers for Medicare & Medicaid Services Data Breach

CMS Network Server Breach Affects 107,000+ Medicare Beneficiaries

critical severityReported June 30, 2025HHS OCR VerifiedMaryland

What happened in the Centers for Medicare & Medicaid Services data breach?

The Centers for Medicare & Medicaid Services data breach was reported on June 30, 2025 and affected 107,154 individuals. The breach type was Hacking/IT Incident involving Network Server. This breach occurred in Maryland. Under HIPAA, affected patients must be notified within 60 days and may be entitled to credit monitoring services.

Harding Hall

107,154

Individuals Affected

Hacking/IT Incident

Breach Type

Network Server

Breach Location

Business Associate

Scale:Larger than 84% of healthcare breaches

1 year ago

HIPAA Category:hacking/IT incident

Visibility:national

Centers for Medicare & Medicaid Services Breach Details

Healthcare Data Breach Report: Centers for Medicare & Medicaid Services

Breach Overview

The Centers for Medicare & Medicaid Services (CMS), a federal agency operating under the U.S. Department of Health and Human Services, reported a significant data breach affecting 107,154 individuals on June 30, 2025. The breach resulted from unauthorized access to a network server, compromising sensitive healthcare and personal information maintained by the agency. CMS is responsible for administering Medicare, Medicaid, and the Children's Health Insurance Program (CHIP), serving millions of beneficiaries nationwide. This incident represents a substantial security failure at a critical federal healthcare infrastructure organization and has implications for beneficiaries across multiple states, with the breach submission originating from Maryland.

Discovery and Response Timeline

The specific discovery date and investigation timeline have not been detailed in the breach submission, though the June 30, 2025 submission date indicates the breach was reported to the HHS Office for Civil Rights within the required timeframe under HIPAA Breach Notification Rule regulations. CMS would have been required to conduct a thorough investigation to determine the scope of unauthorized access, identify affected individuals, and assess what protected health information (PHI) may have been compromised. Standard protocol for federal agencies involves coordination with cybersecurity specialists, law enforcement notification when appropriate, and comprehensive forensic analysis of the compromised network server. The agency would have implemented immediate containment measures to prevent further unauthorized access and secured the affected systems pending remediation.

Technical Details of the Breach

The breach occurred on a network server, which typically indicates a vulnerability in the organization's IT infrastructure rather than a physical theft or loss of devices. Network server breaches commonly result from exploitation of unpatched software vulnerabilities, weak authentication mechanisms, compromised credentials, or advanced persistent threats (APTs). Attackers may have gained initial access through phishing campaigns targeting CMS employees, exploitation of remote access vulnerabilities, or compromise of third-party vendor access points. Once inside the network perimeter, threat actors could have moved laterally through the system to locate and exfiltrate databases containing beneficiary information. The federal nature of CMS makes it a high-value target for sophisticated threat actors, including state-sponsored groups and organized cybercriminal enterprises seeking healthcare data for identity theft, fraud, or espionage purposes.

Organizational Context and Scope

The Centers for Medicare & Medicaid Services is the largest healthcare payer in the United States, operating as a federal agency within HHS. CMS administers healthcare coverage for approximately 150 million Americans through Medicare (primarily seniors and disabled individuals), Medicaid (low-income individuals and families), and CHIP (children in moderate-income families). The agency maintains one of the most comprehensive healthcare databases in the world, containing decades of medical claims, beneficiary demographics, and healthcare utilization data. CMS operates regional offices across all 50 states and territories, with headquarters in Baltimore, Maryland—the state listed in this breach submission. The agency's IT infrastructure is critical national healthcare infrastructure, and any compromise represents a significant public health and security concern affecting beneficiaries nationwide.

Impact on Affected Individuals

The breach affected 107,154 individuals, representing a substantial portion of the Medicare and Medicaid beneficiary population. These individuals likely include Medicare beneficiaries (typically age 65 and older), disabled individuals under 65 enrolled in Medicare, Medicaid recipients, and CHIP enrollees. The affected population spans multiple states, though the breach was submitted from Maryland. Individuals whose information was stored on the compromised network server may have had access to their personal identifiers, healthcare claims information, medical history, prescription data, and potentially Social Security numbers or financial information used for benefit administration. CMS would have been required under HIPAA to notify affected individuals of the breach, the types of information compromised, steps being taken to mitigate harm, and recommended protective actions. Notification would have been provided by first-class mail to last known addresses on file, with additional notification through CMS's beneficiary communication channels.

Regulatory and Industry Context

Under the HIPAA Breach Notification Rule, CMS as a covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of a breach of unsecured PHI. The agency must also notify prominent media outlets and the HHS Office for Civil Rights. This breach, affecting over 100,000 individuals, likely triggered media notification requirements due to the threshold of 500 or more residents of a state or jurisdiction. Network server breaches represent an increasing threat in healthcare, with the HHS Office for Civil Rights reporting that hacking incidents account for the majority of large-scale healthcare data breaches in recent years. The healthcare sector remains a primary target for cybercriminals due to the high value of medical records on the dark web, where a complete medical record can sell for 10-50 times the price of a stolen credit card number. Federal healthcare agencies face particularly sophisticated threats from advanced threat actors with significant resources and expertise. CMS's breach underscores the ongoing challenges in securing massive centralized healthcare databases against determined adversaries.

What Data Was Exposed

Based on CMS's role and typical network server breaches, the following protected health information and personal identifiers may have been exposed: ### Personal Identifiers - Social Security numbers - Names and addresses - Date of birth - Contact information (phone numbers, email addresses) - Medicare beneficiary identification numbers - Medicaid identification numbers ### Healthcare Information - Medical claims and billing records - Diagnosis codes and medical conditions - Prescription medication information - Healthcare provider information and visit history - Insurance coverage details and eligibility status - Prior authorization records ### Financial Information - Bank account information used for direct deposit of benefits - Payment and claims payment history - Deductible and out-of-pocket cost information ### Administrative Data - Enrollment and disenrollment records - Beneficiary status information - Plan selection and coverage history - Correspondence and communication records

Risks to Patients

Individuals affected by this breach face multiple serious risks: ### Identity Theft and Fraud Exposed Social Security numbers and personal identifiers create substantial risk for identity theft. Threat actors can use this information to open fraudulent accounts, apply for credit, or commit tax fraud. Medicare and Medicaid beneficiaries are particularly vulnerable due to their typically older age and potential unfamiliarity with identity theft monitoring. ### Medical Identity Theft Combined exposure of personal identifiers with medical information enables medical identity theft, where criminals use stolen information to obtain healthcare services, prescription medications, or medical equipment fraudulently. This can result in false medical records, incorrect billing, and compromised medical history accuracy. ### Healthcare Fraud Exposed Medicare and Medicaid identification numbers can be used to fraudulently bill for healthcare services, prescription medications, or durable medical equipment. Criminals may submit false claims or obtain services using stolen beneficiary identities. ### Financial Fraud Exposed bank account information and financial details create risk for unauthorized withdrawals, fraudulent benefit transfers, or financial account compromise. ### Privacy Violations and Stigma Exposure of sensitive medical information including diagnoses, medications, and healthcare utilization creates privacy violations and potential for discrimination or stigmatization based on disclosed health conditions. ### Phishing and Social Engineering Exposed contact information and personal details enable targeted phishing campaigns and social engineering attacks designed to compromise additional accounts or extract further sensitive information.

What to Do If You Were Affected by the Centers for Medicare & Medicaid Services Breach

Monitor credit reports from all three major credit bureaus (Equifax, Experian, TransUnion) for unauthorized accounts or inquiries. Consider placing a fraud alert or credit freeze with each bureau to prevent unauthorized credit applications. CMS should provide information about free credit monitoring services offered as part of breach remediation.
Review Medicare and Medicaid statements and claims records regularly for unauthorized services, prescriptions, or provider visits. Report any suspicious activity immediately to CMS, your state Medicaid agency, or your Medicare Advantage plan. Contact your healthcare providers to verify that claims attributed to you are accurate.
Change passwords for any online accounts associated with Medicare or Medicaid, including Medicare.gov accounts and state Medicaid portals. Use strong, unique passwords and enable multi-factor authentication where available. Do not reuse passwords across different accounts.
Be vigilant against phishing emails, text messages, and phone calls claiming to be from CMS, Medicare, Medicaid, or healthcare providers. Do not click links or provide personal information in response to unsolicited communications. Verify requests by contacting organizations directly using official phone numbers or websites.
Consider placing a fraud alert or credit freeze with the three major credit bureaus to prevent unauthorized credit applications. A fraud alert lasts one year (seven years for identity theft victims) and requires creditors to verify your identity before opening new accounts.
Monitor financial accounts and bank statements for unauthorized transactions. Set up account alerts with your financial institutions to notify you of unusual activity. Report any fraudulent transactions immediately to your bank and file a report with the Federal Trade Commission at IdentityTheft.gov.
Obtain a copy of your Social Security Administration earnings record and verify accuracy. Contact SSA if you notice unauthorized work history or earnings. This helps prevent fraudulent benefit claims or tax fraud using your Social Security number.
Document all breach-related communications from CMS and maintain records of any identity theft or fraud incidents. Keep copies of credit reports, fraud reports, and correspondence with financial institutions and government agencies for your records and potential future claims.

Monitor Your Medical Records

Request copies to check for unauthorized changes

Check More Maryland Breaches

Search all breaches reported in Maryland

Were You Affected?

Patients affected by large healthcare data breaches may be eligible for compensation through class action lawsuits.

Learn about data breach lawsuits

Technical Notes

This breach involved unauthorized access to a network server, indicating a cybersecurity compromise of CMS's IT infrastructure rather than physical loss or theft of devices. Network server breaches typically result from one or more of the following attack vectors: ### Common Attack Vectors for Network Server Breaches - **Unpatched Vulnerabilities**: Exploitation of known software vulnerabilities in operating systems, web applications, or network services that had not been patched with security updates - **Credential Compromise**: Theft or compromise of legitimate user credentials through phishing, credential stuffing, or insider threats, allowing attackers to authenticate as authorized users - **Remote Access Exploitation**: Compromise of remote access systems (VPN, RDP, SSH) through weak authentication, default credentials, or unpatched vulnerabilities - **Supply Chain Compromise**: Compromise through third-party vendors, contractors, or software providers with access to CMS network infrastructure - **Advanced Persistent Threats (APTs)**: Sophisticated, targeted attacks by well-resourced threat actors including state-sponsored groups conducting espionage or data exfiltration ### Data Exfiltration Methods Once inside the network, attackers likely used techniques such as lateral movement through network segmentation, privilege escalation to access sensitive databases, and data exfiltration through encrypted channels or cloud storage services to avoid detection. ### Federal Healthcare Infrastructure Implications As a federal agency managing critical healthcare infrastructure, CMS faces unique cybersecurity challenges including sophisticated nation-state threats, the high value of healthcare data, and the complexity of securing legacy systems integrated with modern infrastructure. The breach demonstrates that even well-resourced federal agencies face significant cybersecurity risks from determined adversaries. ### Forensic Investigation Requirements CMS would have conducted comprehensive forensic analysis including timeline reconstruction, identification of initial compromise vector, scope determination of data accessed, and assessment of whether data was exfiltrated or merely accessed. The agency would have coordinated with federal cybersecurity authorities including CISA (Cybersecurity and Infrastructure Security Agency) and potentially law enforcement.

Centers for Medicare & Medicaid Services Has 2 Reported Breaches

This organization has been involved in multiple reported data breaches.

2023-07-28—2,342,357 affected(Hacking/IT Incident)

View full breach history for Centers for Medicare & Medicaid Services

Frequently Asked Questions

How many people were affected by the Centers for Medicare & Medicaid Services data breach?

The Centers for Medicare & Medicaid Services data breach affected 107,154 individuals. It was reported to the HHS Office for Civil Rights on June 30, 2025 and classified as a hacking/it incident incident in Maryland.

When was the Centers for Medicare & Medicaid Services breach reported?

The Centers for Medicare & Medicaid Services breach was reported to the U.S. Department of Health and Human Services Office for Civil Rights on June 30, 2025. Under HIPAA, covered entities must report breaches affecting 500 or more individuals within 60 days of discovery.

What type of breach occurred at Centers for Medicare & Medicaid Services?

The Centers for Medicare & Medicaid Services breach was classified as a "Hacking/IT Incident" incident involving "Network Server." This breach is rated critical severity based on the number of individuals affected and the type of data involved.

What data was exposed in the Centers for Medicare & Medicaid Services breach?

What should I do if I was affected by the Centers for Medicare & Medicaid Services data breach?

1. Monitor credit reports from all three major credit bureaus (Equifax, Experian, TransUnion) for unauthorized accounts or inquiries. Consider placing a fraud alert or credit freeze with each bureau to prevent unauthorized credit applications. CMS should provide information about free credit monitoring services offered as part of breach remediation. 2. Review Medicare and Medicaid statements and claims records regularly for unauthorized services, prescriptions, or provider visits. Report any suspicious activity immediately to CMS, your state Medicaid agency, or your Medicare Advantage plan. Contact your healthcare providers to verify that claims attributed to you are accurate. 3. Change passwords for any online accounts associated with Medicare or Medicaid, including Medicare.gov accounts and state Medicaid portals. Use strong, unique passwords and enable multi-factor authentication where available. Do not reuse passwords across different accounts. 4. Be vigilant against phishing emails, text messages, and phone calls claiming to be from CMS, Medicare, Medicaid, or healthcare providers. Do not click links or provide personal information in response to unsolicited communications. Verify requests by contacting organizations directly using official phone numbers or websites. 5. Consider placing a fraud alert or credit freeze with the three major credit bureaus to prevent unauthorized credit applications. A fraud alert lasts one year (seven years for identity theft victims) and requires creditors to verify your identity before opening new accounts. 6. Monitor financial accounts and bank statements for unauthorized transactions. Set up account alerts with your financial institutions to notify you of unusual activity. Report any fraudulent transactions immediately to your bank and file a report with the Federal Trade Commission at IdentityTheft.gov. 7. Obtain a copy of your Social Security Administration earnings record and verify accuracy. Contact SSA if you notice unauthorized work history or earnings. This helps prevent fraudulent benefit claims or tax fraud using your Social Security number. 8. Document all breach-related communications from CMS and maintain records of any identity theft or fraud incidents. Keep copies of credit reports, fraud reports, and correspondence with financial institutions and government agencies for your records and potential future claims.

What are the risks to patients from the Centers for Medicare & Medicaid Services breach?

How do I file a HIPAA complaint about the Centers for Medicare & Medicaid Services breach?

You can file a HIPAA complaint with the HHS Office for Civil Rights (OCR) online at ocrportal.hhs.gov within 180 days of discovering the violation. The complaint must identify the covered entity (Centers for Medicare & Medicaid Services) and describe the acts or omissions you believe violated HIPAA. You can also contact OCR's toll-free hotline at 1-800-368-1019.

How can I check if I was affected by a healthcare data breach?

You can search for healthcare data breaches by provider name, state, or breach type using MedicalRecords.com's free Breach Check tool at medicalrecords.com/breach-check. The tool searches 1,638 breaches reported to the HHS Office for Civil Rights. Covered entities are also required to notify affected individuals directly.