Hackers stole income, immigration and tax data in Healthcare.gov breach, government confirms

Image Credits: Getty Images

Hackers siphoned off thousands of Healthcare.gov applications by breaking into the accounts of brokers and agents tasked with helping customers sign up for healthcare plans.

The Centers for Medicare and Medicaid Services (CMS) said in a post buried on its website that the hackers obtained “inappropriate access” to a number of broker and agent accounts, which “engaged in excessive searching” of the government’s healthcare marketplace systems.

CMS didn’t say how the attackers gained access to the accounts, but said it shut off the affected accounts “immediately.”

In a letter sent to affected customers this week (and buried on the Healthcare.gov website), CMS disclosed that sensitive personal data — including partial Social Security numbers, immigration status and some tax information — may have been taken.

According to the letter, the data included:

But the government said that no bank account information — including credit card numbers, or diagnostic and treatment information — was taken.

“Breaches that include personally identifiable information are always dangerous because they can lead to identity theft,” Andrew Blaich, head of Device Intelligence at Lookout. “Not only can the attacker steal the identity of anyone in the breach, but they can also use this information to appear credible when crafting mobile spear-phishing messages against their targets.”

“This is especially true if the data that was leaked is accurate, as health information, family relationships and insurance information can make it extremely easy for an attacker to steal the identity of anyone affected by the breach,” he said.

President Obama’s healthcare law, the Affordable Care Act — known as “Obamacare” — allows Americans to obtain health insurance if they are not already covered. In order to sign up for healthcare plans, customers have to submit sensitive data. Some 11.8 million people signed up for coverage for 2018.

CMS previously said that the breach affected 75,000 individuals, but a person familiar with the investigation said that the number is expected to change. The stolen files also included data on children.

A spokesperson said CMS is expected to give an update early next week at the latest.

Healthcare.gov’s enrollment period is set to close on December 15.

Hackers breach Healthcare.gov system, taking files on 75,000 people

Latest Stories