US-based healthcare provider Welltok suffered a data breach

A newly discovered data breach incident has affected Welltok, a United States-based Healthcare SaaS provider. Based on reports, the incident exposed the personal information of approximately 8.5 million patients, marking it the second-largest incident involving the MOVEit software vulnerability, following Maximus, which impacted 11 million individuals.

Welltok, known for its collaboration with health service providers across the U.S., offers online wellness programs, maintains databases with patient data, provides predictive analytics, and supports healthcare needs such as medication observance and pandemic response.

Reports claimed the breach occurred on July 26, 2023, resulting from a hacking incident targeting the company’s flawed MOVEit Transfer server.

 

Welltok claimed it had already applied the security updates the MOVEit software vendor released to address the flaw.

 

According to a company representative, Welltok immediately applied security updates provided by the software vendor to fix the MOVEit security vulnerability. Unfortunately, the company still fell victim to the flaw and the breach exposed sensitive patient data.

The confirmed data in the leak are full names, email addresses, physical addresses, telephone numbers, Social Security Numbers (SSNs), Medicare/Medicaid ID numbers, and specific Health Insurance details.

The impact of this breach has reached various states, affecting healthcare institutions in Minnesota, Alabama, Kansas, North Carolina, Michigan, Nebraska, Illinois, and Massachusetts. Several healthcare providers, such as Blue Cross and Blue Shield entities, Corewell Health, Faith Regional Health Services, and others, were confirmed to be among the affected organisations.

Welltok initially avoided disclosing the number of individuals impacted by the breach. However, recent reports on the U.S. Department of Health and Human Services breach portal confirm that the data breach affected approximately 8,493,379. This incident shows the growing threat to healthcare data security and raises concerns about the vulnerability of systems used by healthcare service providers.

Earlier this year, the Clop ransomware gang exploited a zero-day vulnerability in MOVEit software, affecting thousands of organisations globally and impacting over 77 million people. The Welltok breach is one of the latest additions to incidents that involved the MOVEit vulnerability.

This event reveals the persistent challenges in safeguarding sensitive healthcare data in an increasingly sophisticated cybercriminal community.