Article Details
Scrape Timestamp (UTC): 2023-11-22 18:24:29.184
Original Article Text
Click to Toggle View
Welltok data breach exposes data of 8.5 million US patients. Healthcare SaaS provider Welltok is warning that a data breach exposed the personal data of nearly 8.5 million patients in the U.S. after a file transfer program used by the company was hacked in a data theft attack. Welltok works with health service providers across the U.S., maintaining online wellness programs, holding databases with personal patient data, generating predictive analytics, and supporting healthcare needs like medication adherence and pandemic response. Earlier this year, the Clop ransomware gang exploited a zero-day vulnerability in the MOVEit software to breach thousands of organizations worldwide, following up with extortion demands and data leaks impacting over 77 million people. Welltok published a notice of a data incident in late October, warning that its MOVEit Transfer server was breached on July 26, 2023. This occurred despite applying the security updates as soon as those were made available by the vendor. Patient data was exposed during the breach, including full names, email addresses, physical addresses, and telephone numbers. For some, it also includes Social Security Numbers (SSNs), Medicare/Medicaid ID numbers, and certain Health Insurance information. The impact of the breach impacted institutions in various states, including Minnesota, Alabama, Kansas, North Carolina, Michigan, Nebraska, Illinois, and Massachusetts, with the following healthcare providers said to be impacted: Initial estimates about the number of impacted individuals varied as Welltok didn’t immediately disclose this information. However, earlier today, the firm reported on the U.S. Department of Health and Human Services breach portal that the data breach has been confirmed to impact 8,493,379 people. This figure places the Welltok breach as the second largest MOVEit data breach after services contractor Maximus, whose data breach affected 11 million people.
Daily Brief Summary
Welltok, a Healthcare SaaS provider, experienced a major data breach exposing the personal data of approximately 8.5 million U.S. patients.
The breach occurred due to a hack of the company's file transfer program, MOVEit, which was previously targeted by the Clop ransomware gang exploiting a zero-day vulnerability.
Personal data exposed in the breach comprise full names, email addresses, physical addresses, telephone numbers, and in some cases, sensitive information like Social Security Numbers, Medicare/Medicaid IDs, and health insurance details.
The breach was first acknowledged by Welltok in late October when a notice was published, despite the firm having applied all available security updates from the vendor at the time.
Numerous healthcare providers across multiple states, including Minnesota, Alabama, Kansas, North Carolina, Michigan, Nebraska, Illinois, and Massachusetts, have been affected.
The breach ranks as the second-largest MOVEit incident to date next to the Maximus breach, according to reports filed with the U.S. Department of Health and Human Services breach portal.