FEDERALItem 8.01 · voluntaryHackingGovernmentProfessional ServicesGovernmentVulnerability ExploitZero-DaySupply Chain (3P Vendor)Customer Data InvolvedDownstream VictimsPIIPHIGovernment IDCriticalActive

MAXIMUS, Inc.

bd_3bd082ea9757a6fa · schema v1 · pii pii-v1

Severity

Critical

Financial impact

$15.00M

Discovered

—

Filed

Jul 26, 2023

To disclose

—

Affected

8,000,000

Linked

17 filings

Confidence

91%

Full breach record for MAXIMUS, Inc. →7 incidents on file

Maximus, Inc. disclosed via Form 8-K Item 8.01 that it was affected by the MOVEit zero-day vulnerability disclosed by Progress Software on May 31, 2023. An unauthorized third party accessed personal information — including Social Security numbers and protected health information — of at least 8 to 11 million individuals tied to government program data shared via MOVEit. Maximus estimates approximately $15 million in investigation and remediation costs for Q ending June 30, 2023. Investigation ongoing.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

Jul 26, 2023

Filed

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

This filing is one of 17 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

California State AGbd_bf25ea19ea12a1242023-08-18 · +23dVerified
Indiana State AGbd_45d3fdf48f1c933d2023-08-24 · +29dVerified by operator
Vermont State AGbd_67d6131ab83daa012023-08-25 · +30dVerified by operator
Delaware State AGbd_97027e573fc51e132023-08-25 · +30dVerified by operator

Show 6 more filings ↓up to 168d gap

Washington State AGbd_d4deac1eb085d27a2023-08-25 · +30dVerified
New Hampshire State AGbd_fe9387821fda92642023-08-25 · +30dVerified by operator
Hawaii State AGbd_d3d3db6e2dd7a7a82023-08-26 · +31dVerified by operator
Oregon State AGbd_4a2584ab84dfe0f12023-08-29 · +34dVerified by operator
South Carolina State AGbd_a90da3e7c4e0509c2023-08-29 · +34dVerified
Idaho State AGbd_5312733f463970a32024-01-10 · +168dVerified by operator

Showing first 10 of 16 linked disclosures.

Name: MAXIMUS, Inc.
norm: maximus
SEC CIK: 0001032220
Domain: maximus.com

Name: MAXIMUS, Inc.
norm: maximus
SEC CIK: 0001032220
Domain: maximus.com
Industry: GovernmentllmProfessional Servicesllm

Discovered: —
Materiality determined: —
Notification sent: —
Affected individuals: 8,000,000nationwide
Data types: PIIPHIGovernment ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1195 Supply Chain Compromise
Threat actor: External
Regulator citations: Notifying federal and state regulatorsCooperating with law enforcement
Initial access: exploit_public_facing

During the incident: Commenced an investigation of the incident with the assistance of outside legal, forensic and data analytics experts
Taken remedial steps to address the reported vulnerabilities
Cooperating with law enforcement regarding this cybersecurity incident
Notifying its customers as well as federal and state regulators
Will provide appropriate notifications to individuals affected by this incident
Individuals receiving notice will be offered free credit monitoring and identity restoration services
Changes made: Taken remedial steps to address the reported vulnerabilities
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 10 states

View merged incident ↗

SEC 8-KJul 26 · first · this page

California State AG+23d

Indiana State AG+29d

Vermont State AG+30d

Delaware State AG+30d

Washington State AG+30d

New Hampshire State AG+30d

Hawaii State AG+31d

Oregon State AG+34d

South Carolina State AG+34d

Idaho State AG+168d

Pattern: first filing Jul 26, last Jan 10 (ID) — a 168-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 16 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.sec.gov/Archives/edgar/data/1032220/000103222023000061/mms-20230726.htm
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jul 26, 2023
Raw hash: 81fda65c6acf1bbbb828f80824a7765a2240dee9ac15a284ea0bcb88bdb8b14e

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html32.5 KB

Download View at source

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityMAXIMUS, Inc.

Victim entityMAXIMUS, Inc.

IncidentThird-Party / Supply Chain

Stated responseCommenced an investigation of the incident with the assistance of outside legal, forensic and data analytics experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.sec.gov

Source filing