HackingVulnerability ExploitCapture Stored DataSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedPIIIDENTITY_BASICLowContained
Maximus, Inc and its subsidiaries
bd_bf25ea19ea12a124 · schema v1 · pii pii-v1
Full breach record for Maximus, Inc and its subsidiaries →Maximus Human Services, Inc. disclosed that an unauthorized party exploited a previously unknown vulnerability in Progress Software's MOVEit Transfer application to access files containing personal information. The incident occurred between May 27 and May 31, 2023, and was detected on May 30, 2023. Maximus took the application offline, applied patches, engaged forensic experts, and notified law enforcement. Affected individuals are offered two years of credit monitoring and identity restoration services.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-572076
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 18, 2023
- Raw hash
- 729b6219b06307c5c515b38a3683b8f5da764d234c8a0c839f8c560560500b29
Reporting entity
- Name
- Maximus, Inc and its subsidiariesnorm: maximus inc and its subsidiaries
Victim entity
- Name
- Maximus, Inc and its subsidiariesnorm: maximus inc and its subsidiaries
Incident
- Discovered
- May 30, 2023
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- Not disclosed
- Data types
- PIIIDENTITY_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Third party
- via Progress Software Corporation
- Initial access
- supply_chain
Compliance
- Time to disclose
- 11 weeks(80 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.