Centers for Medicare & Medicaid Services

# Healthcare Data Breach Report: Centers for Medicare & Medicaid Services ## Breach Overview The Centers for Medicare & Medicaid Services (CMS), a federal agency operating under the U.S. Department of Health and Human Services, reported a significant data breach affecting 107,154 individuals on June 30, 2025. The breach resulted from unauthorized access to a network server, compromising sensitive healthcare and personal information maintained by the agency. CMS is responsible for administering Medicare, Medicaid, and the Children's Health Insurance Program (CHIP), serving millions of beneficiaries nationwide. This incident represents a substantial security failure at a critical federal healthcare infrastructure organization and has implications for beneficiaries across multiple states, with the breach submission originating from Maryland. ## Discovery and Response Timeline The specific discovery date and investigation timeline have not been detailed in the breach submission, though the June 30, 2025 submission date indicates the breach was reported to the HHS Office for Civil Rights within the required timeframe under HIPAA Breach Notification Rule regulations. CMS would have been required to conduct a thorough investigation to determine the scope of unauthorized access, identify affected individuals, and assess what protected health information (PHI) may have been compromised. Standard protocol for federal agencies involves coordination with cybersecurity specialists, law enforcement notification when appropriate, and comprehensive forensic analysis of the compromised network server. The agency would have implemented immediate containment measures to prevent further unauthorized access and secured the affected systems pending remediation. ## Technical Details of the Breach The breach occurred on a network server, which typically indicates a vulnerability in the organization's IT infrastructure rather than a physical theft or loss of devices. Network server breaches commonly result from exploitation of unpatched software vulnerabilities, weak authentication mechanisms, compromised credentials, or advanced persistent threats (APTs). Attackers may have gained initial access through phishing campaigns targeting CMS employees, exploitation of remote access vulnerabilities, or compromise of third-party vendor access points. Once inside the network perimeter, threat actors could have moved laterally through the system to locate and exfiltrate databases containing beneficiary information. The federal nature of CMS makes it a high-value target for sophisticated threat actors, including state-sponsored groups and organized cybercriminal enterprises seeking healthcare data for identity theft, fraud, or espionage purposes. ## Organizational Context and Scope The Centers for Medicare & Medicaid Services is the largest healthcare payer in the United States, operating as a federal agency within HHS. CMS administers healthcare coverage for approximately 150 million Americans through Medicare (primarily seniors and disabled individuals), Medicaid (low-income individuals and families), and CHIP (children in moderate-income families). The agency maintains one of the most comprehensive healthcare databases in the world, containing decades of medical claims, beneficiary demographics, and healthcare utilization data. CMS operates regional offices across all 50 states and territories, with headquarters in Baltimore, Maryland—the state listed in this breach submission. The agency's IT infrastructure is critical national healthcare infrastructure, and any compromise represents a significant public health and security concern affecting beneficiaries nationwide. ## Impact on Affected Individuals The breach affected 107,154 individuals, representing a substantial portion of the Medicare and Medicaid beneficiary population. These individuals likely include Medicare beneficiaries (typically age 65 and older), disabled individuals under 65 enrolled in Medicare, Medicaid recipients, and CHIP enrollees. The affected population spans multiple states, though the breach was submitted from Maryland. Individuals whose information was stored on the compromised network server may have had access to their personal identifiers, healthcare claims information, medical history, prescription data, and potentially Social Security numbers or financial information used for benefit administration. CMS would have been required under HIPAA to notify affected individuals of the breach, the types of information compromised, steps being taken to mitigate harm, and recommended protective actions. Notification would have been provided by first-class mail to last known addresses on file, with additional notification through CMS's beneficiary communication channels. ## Regulatory and Industry Context Under the HIPAA Breach Notification Rule, CMS as a covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of a breach of unsecured PHI. The agency must also notify prominent media outlets and the HHS Office for Civil Rights. This breach, affecting over 100,000 individuals, likely triggered media notification requirements due to the threshold of 500 or more residents of a state or jurisdiction. Network server breaches represent an increasing threat in healthcare, with the HHS Office for Civil Rights reporting that hacking incidents account for the majority of large-scale healthcare data breaches in recent years. The healthcare sector remains a primary target for cybercriminals due to the high value of medical records on the dark web, where a complete medical record can sell for 10-50 times the price of a stolen credit card number. Federal healthcare agencies face particularly sophisticated threats from advanced threat actors with significant resources and expertise. CMS's breach underscores the ongoing challenges in securing massive centralized healthcare databases against determined adversaries.

# Healthcare Data Breach Report: Centers for Medicare & Medicaid Services ## Opening Summary On July 28, 2023, the Centers for Medicare & Medicaid Services (CMS), a major federal healthcare agency operating in Maryland, reported a significant data breach affecting approximately 2,342,357 individuals. The breach resulted from a hacking incident targeting the organization's network server infrastructure. This incident represents one of the largest healthcare data breaches reported in recent years, with potential exposure of sensitive personal health information and beneficiary data maintained by CMS systems. The breach was classified as a hacking/IT incident, indicating that unauthorized actors gained access to protected systems through cybersecurity vulnerabilities rather than through physical theft or loss of devices. ## Company Response and Investigation Timeline CMS discovered the unauthorized access to its network server systems and initiated an immediate investigation to determine the scope and nature of the compromise. Upon discovery, the organization followed HIPAA Breach Notification Rule requirements by conducting a comprehensive risk assessment to evaluate whether the accessed information posed a significant risk of harm to affected individuals. The investigation process involved forensic analysis of network logs, access patterns, and system activity to identify what data may have been accessed and the timeframe during which the breach occurred. CMS coordinated with federal law enforcement and cybersecurity specialists to investigate the incident and prevent further unauthorized access. Notification letters were prepared and distributed to affected individuals in accordance with HIPAA requirements, which mandate notification without unreasonable delay and no later than 60 calendar days after discovery of a breach. The submission date of July 28, 2023, indicates when CMS formally reported the breach to the Department of Health and Human Services Office for Civil Rights (OCR), as required by federal regulations. ## Specific Details of the Breach The breach occurred on a network server, which typically means that attackers exploited vulnerabilities in internet-facing systems, remote access points, or internal network infrastructure to gain unauthorized access to CMS databases and file systems. Network server breaches of this magnitude often result from one or more of the following vectors: unpatched software vulnerabilities, weak authentication credentials, compromised remote access credentials, phishing attacks targeting employee accounts with system access, or exploitation of misconfigured cloud storage or network shares. The fact that a business associate was involved in this breach indicates that CMS may have been storing or processing data through third-party vendors or contractors who maintain systems on behalf of the agency. This adds complexity to the breach response, as CMS must coordinate notification and remediation efforts across multiple organizations. Network server breaches typically allow attackers extended access periods before detection, potentially enabling them to exfiltrate large volumes of data or maintain persistent access for reconnaissance purposes. ## Organizational Context and Operations The Centers for Medicare & Medicaid Services is a federal agency within the Department of Health and Human Services responsible for administering Medicare, Medicaid, and the Children's Health Insurance Program (CHIP). CMS operates nationwide but maintains significant operations in Maryland, where this breach was reported. The organization processes and maintains health insurance claims, beneficiary enrollment information, and personal health data for tens of millions of Americans. CMS systems are among the largest healthcare databases in the United States, containing comprehensive records of Medicare beneficiaries (primarily seniors aged 65 and older), Medicaid recipients, and CHIP enrollees. The agency's network infrastructure supports claims processing, eligibility determination, provider enrollment, and beneficiary services across all 50 states and U.S. territories. Given the scale of CMS operations and the sensitive nature of the data it maintains, this organization represents a high-value target for cybercriminals and state-sponsored threat actors seeking access to healthcare and personal financial information. ## Patient Impact and Affected Populations Approximately 2,342,357 individuals were affected by this breach, making it a breach of national significance. The affected population likely includes Medicare beneficiaries, Medicaid recipients, CHIP enrollees, and potentially healthcare providers and their staff members whose information was stored in CMS systems. These individuals may have had various categories of personal health information and personally identifiable information exposed, depending on which CMS databases were accessed during the breach. Notification letters were sent to affected individuals informing them of the breach, the types of information potentially exposed, and recommended protective actions. The notification process for a breach of this magnitude required coordination across multiple communication channels and languages to ensure all affected parties received timely and understandable information about the incident. Individuals who received breach notification letters were advised to monitor their accounts and credit reports for signs of fraudulent activity and to consider enrolling in credit monitoring services if offered by CMS. ## Data Exposure and Information Types Based on the nature of CMS operations and the network server breach, the following categories of protected health information and personally identifiable information may have been exposed: Social Security numbers, Medicare beneficiary identification numbers, Medicaid identification numbers, names and addresses, dates of birth, health insurance claim information, medical diagnosis and treatment codes, prescription medication information, healthcare provider information, banking and financial account details (for direct deposit and payment purposes), and potentially employment information. The specific data elements exposed would depend on which CMS databases and systems were accessed during the breach. Some affected individuals may have had limited information exposed, while others may have had comprehensive personal health records compromised. The exposure of Social Security numbers combined with health insurance identifiers and medical information creates significant risk for identity theft and medical fraud. ## HIPAA Compliance and Industry Context This breach triggers multiple requirements under the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule. CMS, as a covered entity under HIPAA, is required to maintain administrative, physical, and technical safeguards to protect electronic protected health information (ePHI). The involvement of a business associate indicates that CMS had contractual arrangements requiring the associate to implement equivalent security measures. Network server breaches affecting more than 100,000 individuals are typically reported to major media outlets and constitute breaches of national significance. According to healthcare breach statistics, hacking incidents represent the leading cause of large-scale healthcare data breaches, accounting for the majority of breaches affecting over 10,000 individuals. This incident aligns with broader cybersecurity trends in the healthcare sector, where sophisticated threat actors increasingly target federal healthcare agencies and large health plans due to the volume and value of data maintained in their systems. The breach underscores the ongoing challenges healthcare organizations face in securing complex network infrastructure against determined adversaries.