Loading story…
The Centers for Medicare and Medicaid Services (CMS) exposed some healthcare providers’ Social Security numbers through a downloadable database linked to a new Medicare provider directory, according to reporting by The Washington Post and HIPAA Journal. The directory was built to help seniors identify which doctors and medical providers accept specific insurance plans, but the underlying database was reportedly publicly accessible for several weeks. Reporters said they were able to identify dozens of SSNs by reviewing only a sample of the records, raising concerns about the handling of sensitive provider data in a system CMS had promoted as part of a broader healthcare technology modernization effort.
CMS said the exposure stemmed from providers or their representatives entering information into incorrect fields, and the agency said it is working on a fix while adding stronger submission and validation safeguards. The disclosure renewed criticism of the provider directory’s rollout, which had already faced scrutiny over inaccurate insurance network information. The incident also lands amid heightened concern over Social Security number exposure more broadly, following separate reporting on the National Public Data breach, where a threat actor allegedly stole and leaked a massive trove of personal records that included SSNs and other identifying information.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
CMS said it was working on a fix for the exposed provider directory data and strengthening submission and validation safeguards. The incident also renewed criticism of the portal's rollout and data accuracy problems.
The Washington Post reported that CMS had inadvertently exposed healthcare providers' Social Security numbers through a database used by the Medicare portal. Reporters said they were able to identify dozens of SSNs by reviewing only a sample of records.
A downloadable database tied to the CMS provider directory was publicly accessible for several weeks and contained some healthcare providers' Social Security numbers. The exposure was reportedly caused by provider or representative information being entered into incorrect fields.
CMS created a new provider directory the previous year to help Medicare beneficiaries identify which doctors and medical providers accept specific insurance plans. The portal was presented as a modernization effort to improve healthcare technology.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Several healthcare organizations in the United States have reported significant data breaches resulting in the exposure of protected health information (PHI) for tens of thousands of patients. TriZetto Provider Solutions, a revenue management service provider, discovered unauthorized access to its web portal dating back to November 2024, with attackers accessing historical eligibility transaction reports containing sensitive patient data such as names, addresses, Social Security numbers, and health insurance details. The breach was detected in October 2025, after which immediate remediation steps were taken, including engaging Mandiant for investigation and securing the affected systems. Other incidents include breaches at Morton Drug Company in Wisconsin, Physicians to Children & Adolescents in Kentucky, the Center for Urologic Care of Berks County in Pennsylvania, North Atlantic States Carpenters Health Benefits Fund in Massachusetts, and Millcreek Pediatrics in Delaware. These breaches involved unauthorized network access and resulted in the exposure of PHI, including names, birth dates, medical record numbers, prescription information, and, in some cases, Social Security numbers. Affected organizations have notified impacted individuals and are offering credit monitoring services where appropriate, while also implementing enhanced security measures to prevent future incidents.
Jun 29, 2026
The District of Columbia Department of Health Care Finance (DHCF) disclosed that two publicly accessible web reports exposed underlying personal data for 399,086 DC Medicaid and DC Healthcare Alliance beneficiaries enrolled from 2023 to 2026. Although the reports displayed aggregate enrollment and statistical information, hidden data may have been available to unauthorized visitors from 2023 until the agency identified the issue on July 21, 2026. The exposed fields included Medicaid IDs, dates of birth, provider names, race, gender, ethnicity, and ward; the agency said names, Social Security numbers, and financial-account information were not included. DHCF said the incident was not a cyberattack and that it has found no evidence of access or misuse, but removed the reports, began an internal review and system checks, notified affected individuals, and reported the exposure to the US Department of Health and Human Services.
Sep 28, 2026
Multiple healthcare entities reported **unauthorized access and patient data exposure**, with incidents spanning direct provider compromises and third-party vendor breaches. **Insight Hospital and Medical Center (Chicago)** disclosed suspicious activity in its IT environment, with investigators confirming **unauthorized network access from Aug 22 to Sep 11, 2025**; the organization said the review is ongoing but potentially impacted data includes **names, DOB, SSNs, passport numbers, financial account data, treatment information, and insurance details**. Two extortion groups publicly claimed responsibility: **LockBit** alleged theft of ~`200 GB` and **Termite** claimed `360 GB`, stating it leaked data in late February 2026. In France, attackers stole about **15.8 million administrative files** after breaching health-ministry software supplier **Cegedim Santé**, impacting its *MonLogicielMedical (MLM)* product used by thousands of doctors; the stolen data reportedly included **identity and contact details**, and in a smaller subset (~**165,000** files) **free-text doctors’ notes** that in limited cases contained sensitive medical-history details. Separately, **OCAT, LLC d/b/a Evoke Wellness at Hilliard** updated a breach notification describing **unauthorized network activity** and potential access to patient information; reporting also tied the matter to an **insider misuse** investigation in which a former employee allegedly accessed and sold patient data, though public filings contained **inconsistent timelines** about when the underlying incident occurred and when it was discovered.
Jun 29, 2026