Medicare Data Breach Impacts Almost 1 Million Subscribers
Following the Medicare data breach, you can continue to use your existing Medicare card; beneficiaries with compromised Medicare Beneficiary Identifiers will be sent a new card with a new number.


The personal information of more than 900,000 Medicare beneficiaries was exposed during a data breach that occurred between May 27 and May 31, 2023. Information was stolen exploiting a "vulnerability" in the MOVEit software program used by Medicare contractor Wisconsin Physicians Service Insurance Corporation (WPS) to transfer files during the Medicare claims process, according to the Centers for Medicare & Medicaid Services (CMS), the federal agency that manages the Medicare program.
Notification is being sent by CMS and WPS to the almost 947,000 individuals affected that some of their protected health information (PHI) and personally identifiable information (PII) was compromised in the May 2023 security breach.
2023 saw a record breaking number of cyberattacks, with 2,365 breaches and 343,338,964 victims, according to the 2023 ITRC Annual Data Breach report from the Identity Theft Resource Center. Healthcare companies faced the most cyberattacks industry wide with 809 compromises, and the financial sector came in a close second with 744 compromises, according to idtheftcenter.org. Healthcare led all industries in terms of the number of reported compromises in each of the past five (5) years.

Sign up for Kiplinger’s Free E-Newsletters
Profit and prosper with the best of expert advice on investing, taxes, retirement, personal finance and more - straight to your e-mail.
Profit and prosper with the best of expert advice - straight to your e-mail.
How the breach occurred
WPS provides administrative services to the CMS including the handling of Medicare Part A/B claims. The security breach involved the exploitation of a vulnerability in Progress Software’s MOVEit software, which was used by WPS for transferring files in connection with the services provided to the CMS.
Beginning on May 27, 2023, CL0P Ransomware Gang, also known as TA505, began exploiting a previously unknown vulnerability in Progress Software's managed file transfer (MFT) solution known as MOVEit Transfer. Internet-facing MOVEit Transfer web applications were infected with a web shell named LEMURLOOT, which was then used to steal data from underlying MOVEit Transfer databases, according to the Cybersecurity and Infrastructure Security Agency (CISA).
What information was involved?
- Name
- Social Security Number or Individual Taxpayer Identification Number
- Date of Birth
- Mailing Address
- Gender
- Hospital Account Number
- Dates of Service
- Medicare Beneficiary Identifier (MBI) and/or Health Insurance Claim Number
What is a Medicare Beneficiary Identifier (MBI)?
The Medicare Access and CHIP Reauthorization Act (MACRA) of 2015, required the removal of Social Security numbers from Medicare cards. By April 2019, Medicare Beneficiary Identifiers (MBIs) replaced Social Security numbers on Medicare cards.
On a Medicare card, an MBI will appear similar to this: 1EG4-TE5-MK73. The second, fifth, eighth, and ninth characters are always letters while the first, fourth, seventh, tenth, and eleventh characters are always numbers. There isn't a standard for the third or sixth characters.
The CMS press release said they "are not aware of any reports of identity fraud or improper use of your information as a direct result of this incident." They do advise that you can continue to use your current card to receive services. If CMS determines your MBI was compromised as a result of the breach, a new Medicare card with a new new number will be issued to you. CMS will mail the new card to your address in the coming weeks.
After you get your new card, CMS says you should:
- Follow the instructions in the letter that comes with your new card
- Destroy your old Medicare card
- Inform your providers that you have a new Medicare number
What can you do if you were impacted by the data breach?
Yogi Berra sums up how I feel about giving tips to protect your data — "It's like déjà vu all over again." I hope these tips will now become a habit instead of a defensive measure. Your information is valuable and there is no shortage of bad actors scheming to steal it.
Here are five tips for protecting your identity and data:
- Sign up for 24/7 credit monitoring and activate two-factor authentication
- Never respond to unsolicited requests for information
- Review credit card, bank accounts and loans on a regular basis
- Place a free fraud alert on your credit file. A fraud alert tells creditors to contact you before they open any new accounts or change your existing accounts.
- Freeze your three primary credit reports. In this context, "freezing" means that you prohibit your credit reports from being accessed by most third parties. In return for a fee you get a PIN from the credit bureaus. This PIN acts as an additional key and it must be given in order for your credit reports to be accessed and used to open accounts or obtain loans
Bottom line
The Medicare data breach comes on the heels of the NDP and Change Healthcare breaches. It should prompt everyone to be vigilant about checking bank accounts, loan and credit card accounts and credit reports regularly. These breaches are a fact of life and we have to take regular, affirmative steps to guard against them. It is no longer enough to make inquiries after something happens. A pro-active stance is the best offense and defense when it comes to cybersecurity.
Related Content
Get Kiplinger Today newsletter — free
Profit and prosper with the best of Kiplinger's advice on investing, taxes, retirement, personal finance and much more. Delivered daily. Enter your email in the box and click Sign Me Up.
Donna joined Kiplinger as a personal finance writer in 2023. She spent more than a decade as the contributing editor of J.K.Lasser's Your Income Tax Guide and edited state specific legal treatises at ALM Media. She has shared her expertise as a guest on Bloomberg, CNN, Fox, NPR, CNBC and many other media outlets around the nation. She is a graduate of Brooklyn Law School and the University at Buffalo.
-
RMD Deadline April 1: Five Tax Strategies to Manage Your 2025 Income
Taxable Income The April 1, 2025, deadline for required minimum distributions (RMDs) is fast approaching for retirees who turned 73 in 2024.
By Kelley R. Taylor Published
-
Rising AI Demand Stokes Undersea Investments
The Kiplinger Letter As demand soars for AI, there’s a need to transport huge amounts of data across oceans. Tech giants have big plans for new submarine cables, including the longest ever.
By John Miley Published
-
Return to Your Home Country to Retire: Repatriation Retirement
They came to the U.S. to live and work, but they want to retire in the old country. Here's how to juggle the move back home.
By Alina Tugend Published
-
How Much Does Being Rich Matter in Retirement?
After a certain point, having more money in retirement won't make you any happier, new research shows. Instead, physical health, a sense of purpose, and a minimal amount of non-mortgage debt are more relevant.
By Christy Bieber Published
-
The Three Biggest Fears Keeping Retirees Up at Night
Here are the steps you can take to put those fears to rest and retire with confidence so you can relax and enjoy the life you've planned.
By Pam Krueger Published
-
What Can a Donor-Advised Fund Do for You? (A Lot)
DAFs and private foundations go about helping charities (and those who donate) in different ways. Each comes with its own benefits and restrictions to navigate.
By Julia Chu Published
-
Estate Planning When You Have International Assets
Estate planning gets tricky when you have assets and/or beneficiaries outside the U.S. To avoid costly inheritance mistakes, it pays to understand the basics.
By Kelsey M. Simasko, Esq. Published
-
6 Great Vacation Ideas for Wheelchair Users
These six places provide plenty of travel inspiration for people who use wheelchairs.
By Becca van Sambeck Published
-
Should You Start a Business in Retirement? Here's What You Need to Know
Whether you've always wanted to own your own company or just want to stay active or have more retirement money, starting a business in retirement is possible. Here's what to consider.
By Maurie Backman Published
-
Three Essential Estate Planning Steps to Protect Your Nest Egg
After dedicating years to building your wealth and securing your future, make sure your assets are protected and your loved ones are provided for in the future.
By Nicole Farbo, CFP® Published