HackingStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTPHIHEALTH_BASICMediumContained
Colorado Department of Health Care Policy and Financing
bd_5ebd8c098e6a6f5f · schema v1 · pii pii-v1
Full breach record for Colorado Department of Health Care Policy and Financing →Colorado Department of Health Care Policy & Financing (HCPF) notified consumers of a data breach involving its third-party vendor IBM's use of Progress Software's MOVEit Transfer application. Unauthorized access occurred on or about May 28, 2023, affecting files containing Health First Colorado and CHP+ applicant data, including names, SSNs, and insurance identifiers. HCPF offered two years of credit monitoring via Experian.
Vermont clock✗ VT AG >45 bday36 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 6 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (5) · sorted by filing gap
- bd_276c06374e7a08fcMaine State AGfiled 2024-02-19Candidate
- bd_5167088d02685ddfOregon State AGfiled 2024-02-19Verified
- bd_6f832e7ad75b6a0cDelaware State AGfiled 2024-02-19Verified
- bd_90735d0659ea8b49California State AGfiled 2024-02-19Verified
Show 1 more filing ↓Show fewer ↑up to 1d gap
- bd_a3f112b2ddad6d7aNew Hampshire State AGfiled 2024-02-20(1d gap)Verified
Source provenance
- Source URL
- https://ago.vermont.gov/document/2024-02-19-colorado-department-health-care-policy-financing-progress-software-moveit-data-breach
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 19, 2024
- Raw hash
- fbc8ee591df9802bee32d414f1181cc08637350fd4466bd16a0a27187132428d
Reporting entity
- Name
- Colorado Department of Health Care Policy and Financingnorm: colorado department of health care policy and financing
- Domain
- hcpf.colorado.gov
Victim entity
- Name
- Colorado Department of Health Care Policy and Financingnorm: colorado department of health care policy and financing
- Domain
- hcpf.colorado.gov
Incident
- Discovered
- Jun 13, 2023
- Materiality determined
- Feb 19, 2024
- Notification sent
- Feb 19, 2024
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTPHIHEALTH_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain CompromiseT1078 Valid Accounts
- Threat actor
- ExternalFinancial
- Initial access
- supply_chain
Compliance
- Time to disclose
- 36 weeks(251 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.