HackingVulnerability ExploitClopData ExfiltratedData PublishedTargetedPIIPHIIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICCriticalContained
Colorado Department of Health Care Policy and Financing
bd_b131d9519be28ad6 · schema v1 · pii pii-v1
Full breach record for Colorado Department of Health Care Policy and Financing →The Colorado Department of Health Care Policy and Financing (HCPF) reported a breach affecting 4,662,668 individuals. The incident involved the Clop hacking group exploiting a vulnerability in Progress Software's MOVEit Transfer application on May 31, 2023. Personal and health information of Medicaid and state healthcare program participants was compromised.
This filing is one of 11 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (10) · sorted by filing gap
- bd_651d3456f2cd7362Delaware State AGfiled 2023-08-11(3d gap)Verified
- bd_a26eef2000fb6b18Vermont State AGfiled 2023-08-11(3d gap)Verified
- bd_c8f2a8126cd41b6bMaine State AGfiled 2023-08-11(3d gap)Verified
- bd_cb8d9ebf14bedf02HHS OCRfiled 2023-08-11(3d gap)Verified
Show 6 more filings ↓Show fewer ↑up to 50d gap
- bd_eb9bc01f2d03027bCalifornia State AGfiled 2023-08-11(3d gap)Verified
- bd_b918db91ace38228New Hampshire State AGfiled 2023-08-01(13d gap)Verified
- bd_4107138ac65485a0Maine State AGfiled 2023-10-03(50d gap)Verified
- bd_501ce56cdd46ef11Vermont State AGfiled 2023-10-03(50d gap)Verified
- bd_a36dbca8821d58c1California State AGfiled 2023-10-03(50d gap)Verified
- bd_bc4561bd8522923fDelaware State AGfiled 2023-10-03(50d gap)Verified
Source provenance
- Source URL
- https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/ColoradoDepartmentofHealthCarePolicyFinancing.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 14, 2023
- Raw hash
- 0242631af484a923020d87cc4b00d96d330400bad81f19e94ef0e15224ededc9
Reporting entity
- Name
- Colorado Department of Health Care Policy and Financingnorm: colorado department of health care policy and financing
- Domain
- hcpf.colorado.gov
Victim entity
- Name
- Colorado Department of Health Care Policy and Financingnorm: colorado department of health care policy and financing
- Domain
- hcpf.colorado.gov
Incident
- Discovered
- May 31, 2023
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- 4,662,668
- Data types
- PIIPHIIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASIC
- Attack vector
- Unauthorized Access· Clop
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
- Threat actor
- ClopExternalFinancial
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 11 weeks(75 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.