UMass Chan Medical School in Worcester alerting 134,000 individuals of data breach
WORCESTER - Some 130,000 Massachusetts residents should expect to get notifications starting this week alerting them that their personal data — potentially from Social Security numbers to health information — may have been compromised in a data breach involving UMass Chan Medical School.
The incident affected Massachusetts residents enrolled in specific health-related state programs provided by UMass Chan for the Executive Office of Health and Human Services. The breach occurred in June and involved the software of a widely-used file transfer program called MOVEit, according to the state.
According to published reports, the cyberattack occurred through exploiting a weakness in the MOVEit program, owned by Massachusetts-based Progress Software’s; a managed file transfer service used by thousands of organizations to securely transfer large amounts of sensitive information. It affected some 620 companies and roughly 40 million people.
The data breach was worldwide, impacting numerous agencies on state and federal levels, financial services firms, pension funds and other companies and nonprofit agencies that had subscribed to the program. In Massachusetts, UMass Chan was using the software program to transfer files as part of the service provided by the medical school to state Health and Human Services agencies and programs.
None of the systems used by the state or UMass Chan were affected by the breach.
More: Global hacking campaign: Energy Department and other agencies hit by wave of cyberattacks
An investigation by UMass Chan found that the breach affected individuals who are current or recent past participants in the following programs: MassHealth Premium Assistance Members, MassHealth Community Case Management, State Supplemental Program, Family Resources Center and Executive Office of Elder Affairs and Aging Services Access Point; primarily home care program consumers.
According to the state, the data breach is unlikely to have affected participants in other state health programs.
Stolen information could include birthdates, addresses, health information and health insurance information including policy numbers, Social Security numbers and financial account information. The data breach could also affect household members of the enrolled participants.
Those affected by the data breach can expect to hear from the state and UMass Chan about the specific personal information that might be involved. To minimize effects, those receiving letters, text messages, emails or calls from the state are urged to review their financial information, contact their financial institutions and to monitor credit cards, bank statements and online fund transferring sites for unrecognized activity.
The three national credit monitoring agencies also offer protective services.
UMass Chan is also offering free credit monitoring and identity theft protection services to individuals whose Social Security numbers and/or financial information were involved in this incident.
For more information, visit mass.gov/MOVEitIncident or umassmed.edu.
This article originally appeared on Telegram & Gazette: UMass Chan Medical School alerting 130,000 individuals of data breach
