Colorado Department of Health Care Policy & Financing - HCPF

The Colorado Department of Health Care Policy & Financing (HCPF) disclosed a data breach that impacted more than 4 million individuals.

Threat actors gained access to the affected person's personal and health information as a consequence of a MOVEit attack on IBM, which caused the incident.

The compromised Information includes full name, Social Security number, Medicaid ID number, Medicare ID number, date of birth, home address and other contact information, demographic or income information, clinical and medical information (such as diagnosis/condition, lab results, medication, or other treatment information), and health insurance information.

HCPF is providing access to credit monitoring services for twenty-four months, through Experian, to impacted individuals along with guidance on how to better protect against identity theft and fraud.

Source: https://securityaffairs.com/149498/data-breach/colorado-hcpf-department-data-breach.html

TPRM report: https://scoringcyber.rankiteo.com/company/colorado-department-of-health-care-policy-and-financing

"id": "col35711923",
"linkid": "colorado-department-of-health-care-policy-and-financing",
"type": "Breach",
"date": "08/2023",
"severity": "100",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': '4 million individuals',
                        'industry': 'Healthcare',
                        'location': 'Colorado, USA',
                        'name': 'Colorado Department of Health Care Policy & '
                                'Financing (HCPF)',
                        'type': 'Government Agency'}],
 'attack_vector': 'MOVEit attack on IBM',
 'data_breach': {'number_of_records_exposed': '4 million',
                 'personally_identifiable_information': True,
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['full name',
                                              'Social Security number',
                                              'Medicaid ID number',
                                              'Medicare ID number',
                                              'date of birth',
                                              'home address and other contact '
                                              'information',
                                              'demographic or income '
                                              'information',
                                              'clinical and medical '
                                              'information (such as '
                                              'diagnosis/condition, lab '
                                              'results, medication, or other '
                                              'treatment information)',
                                              'health insurance information']},
 'description': 'The Colorado Department of Health Care Policy & Financing '
                '(HCPF) disclosed a data breach that impacted more than 4 '
                'million individuals. Threat actors gained access to the '
                "affected person's personal and health information as a "
                'consequence of a MOVEit attack on IBM, which caused the '
                'incident.',
 'impact': {'data_compromised': ['full name',
                                 'Social Security number',
                                 'Medicaid ID number',
                                 'Medicare ID number',
                                 'date of birth',
                                 'home address and other contact information',
                                 'demographic or income information',
                                 'clinical and medical information (such as '
                                 'diagnosis/condition, lab results, '
                                 'medication, or other treatment information)',
                                 'health insurance information']},
 'response': {'communication_strategy': 'Providing access to credit monitoring '
                                        'services for twenty-four months, '
                                        'through Experian, to impacted '
                                        'individuals along with guidance on '
                                        'how to better protect against '
                                        'identity theft and fraud.',
              'third_party_assistance': 'Experian'},
 'title': 'Data Breach at Colorado Department of Health Care Policy & '
          'Financing',
 'type': 'Data Breach'}