HackingStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIDENTITY_GOVERNMENTIDENTITY_BASICFINANCIAL_ACCOUNTMediumContained
Colorado Department of Health Care Policy and Financing
bd_a9f8eee865a209bb · schema v1 · pii pii-v1
Full breach record for Colorado Department of Health Care Policy and Financing →The Colorado Department of HealthCare Policy & Financing (HCPF) notified individuals of a breach involving its MOVEit Transfer system, used by third-party vendor IBM. Unauthorized access occurred on or about May 28, 2023, and was discovered by HCPF on June 13, 2023. The incident exposed personal information of Health First Colorado and CHP+ members and providers, including government IDs and financial account data. HCPF offered two years of credit monitoring via Experian. The notification was filed with the New Hampshire Attorney General on October 3, 2023.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/colorado-department-health-care-policy-financing-20231003.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Oct 3, 2023
- Raw hash
- d6096691330a0a8cbda59d78a9c2ed553ad1753cd9bda91d84a5bff53f9cddb4
Reporting entity
- Name
- Colorado Department of Health Care Policy and Financingnorm: colorado department of health care policy and financing
- Domain
- hcpf.colorado.gov
Victim entity
- Name
- Colorado Department of Health Care Policy and Financingnorm: colorado department of health care policy and financing
- Domain
- hcpf.colorado.gov
Incident
- Discovered
- Jun 13, 2023
- Materiality determined
- —
- Notification sent
- Oct 3, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_GOVERNMENTIDENTITY_BASICFINANCIAL_ACCOUNT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain CompromiseT1078 Valid Accounts
- Threat actor
- ExternalFinancial
- Initial access
- supply_chain
Compliance
- Time to disclose
- 16 weeks(112 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.