Colorado Department of Health Care Policy and Financing

Colorado Department of Health Care Policy & Financing (HCPF) notified Delaware residents of a data event involving approximately 324 individuals. The incident stemmed from a vulnerability in Progress Software's MOVEit Transfer application, exploited by an unauthorized actor who accessed files managed by third-party vendor IBM. The breach exposed names, Social Security numbers, Medicaid/Medicare IDs, dates of birth, and medical/insurance information. HCPF launched an investigation, engaged forensic review, and provided 24 months of credit monitoring via Experian to affected Delaware residents. The investigation was ongoing as of the notice date of August 11, 2023.

Affected (this filing): 324

The Colorado Department of Health Care Policy and Financing (HCPF) disclosed a data breach involving its third-party vendor, IBM, which uses Progress Software's MOVEit Transfer application. An unauthorized actor accessed certain HCPF files on or about May 28, 2023. The incident exposed protected health information (PHI) and personal identifiers (SSN, Medicaid/Medicare IDs, DOB, addresses) of Health First Colorado and CHP+ members. HCPF offered two years of credit monitoring via Experian.

The Colorado Department of Health Care Policy & Financing reported a data breach affecting 1,090 Maine residents. The incident was discovered on June 13, 2023, and occurred on May 28, 2023. The breach exposed individuals' names and Social Security numbers. Affected residents were notified on August 11, 2023, and offered two years of identity theft protection services through Experian.

Affected (this filing): 1,090

Colorado Department of Health Care Policy and Financing (HCPF) notified consumers of a data breach involving its third-party vendor, IBM, which uses Progress Software's MOVEit Transfer application. An unauthorized actor accessed certain HCPF files on or about May 28, 2023, containing names, addresses, phone numbers, SSNs, and financial account information for Health First Colorado and CHP+ members/providers. HCPF offered two years of credit monitoring. No HCPF systems were directly compromised.

Colorado Department of Health Care Policy & Financing (HCPF) disclosed a data breach involving personal information of Health First Colorado and CHP+ members and providers. The incident occurred on May 28, 2023, when an unauthorized actor accessed files on the MOVEit Transfer application used by third-party vendor IBM. HCPF discovered the issue on May 31, 2023. Affected data included full names, business mailing addresses, business phone numbers, and Social Security numbers (if used as taxpayer ID). No provider portal credentials or financial account information were involved. HCPF offered two years of credit monitoring and identity restoration via Experian.

Colorado Department of Health Care Policy & Financing (HCPF) disclosed a breach involving its third-party vendor, IBM, which used the Progress Software MOVEit Transfer application. An unauthorized actor accessed HCPF files containing member and provider information (names, addresses, SSNs) on or about May 28, 2023. HCPF offered two years of credit monitoring. The notification was filed in Delaware on October 3, 2023, as a supplemental notice.