Maximus data breach (2023)

FEDERALSEC 8-KFirst filing

Filed Jul 26, 2023bd_3bd082ea9757a6fa

Maximus, Inc. disclosed via Form 8-K Item 8.01 that it was affected by the MOVEit zero-day vulnerability disclosed by Progress Software on May 31, 2023. An unauthorized third party accessed personal information — including Social Security numbers and protected health information — of at least 8 to 11 million individuals tied to government program data shared via MOVEit. Maximus estimates approximately $15 million in investigation and remediation costs for Q ending June 30, 2023. Investigation ongoing.

Affected (this filing): 11,000,000

🦬Montana State AG

🥔Idaho State AG

Filed Jul 28, 2023bd_eab9649547b60fb2

Maximus, Inc. notified Idaho AG on July 28, 2023, of a data breach involving its MOVEit Transfer software. An unauthorized party exploited a zero-day vulnerability in the software between May 27 and May 31, 2023, to exfiltrate files containing personal information of at least 4,852 Idaho residents. Data included names, SSNs, ITINs, DOB, and medical/insurance info. Maximus took the system offline, applied patches, notified law enforcement (FBI), and offered 24 months of credit monitoring.

Affected (this filing): 4,852

💎Delaware State AGlinked via same-victim cross-source · 95%

Filed Aug 25, 2023bd_624423274a86bca1

Maximus Health Services, Inc. notified individuals of a security incident involving the MOVEit Transfer software vulnerability. Unauthorized access occurred between May 27 and May 31, 2023, resulting in the exfiltration of personal information. Maximus took the environment offline, applied vendor patches, and is offering two years of credit monitoring services.

Maximus

Litigation Timing

Timeline