You probably haven’t heard of the Centers for Medicare and Medicaid Systems.

They’re a low-profile division of the Department of Health and Human Services responsible for administering the Affordable Care Act.

Recently, the company announced that they detected anomalous activity in the systems related to the healthcare.gov website that brokers and insurance agents use to assist people who apply for healthcare coverage.

The abnormal activity was detected in the Federally Facilitated Exchange system, and the direct enrollment pathway in particular.  This is connected to (but separate from) the healthcare.gov website itself.

A statement issued by the Centers for Medicare and Medicaid Systems said:

“At this time, we believe that approximately 75,000 individuals’ files were accessed.  While this is a small fraction of the consumer records present on the FFE, any breach of our system is unacceptable… We will continue to work around the clock to help those potentially impacted and ensure the protection of consumer information.”

CMS made it clear that their investigation into the matter was still in its earliest stages.

They did offer the following additional information:

“Upon verification of the breach, CMS took immediate steps to secure the system and consumer information, further investigate the incident, and subsequently notify federal law enforcement.  We are actively engaged in and committed to helping those potentially impacted as well as ensuring the protection of consumer information.”

Additionally, CMS stated that they identified the broker accounts that were associated with the anomalous activity and deactivated them out of an abundance of caution.

At some point in the near future, we can expect that CMS will be contacting those whose data was compromised and providing them with a series of next steps. The agency is already moving to bolster their security measures and promises that they’ll have them in place before the end of October 2018.

If you’ve used the healthcare.gov portal and required the assistance of a broker or insurance agent to get coverage for yourself and your family, there is a small chance your data may have been compromised. However, at this point, there’s no way to be certain.  Be on the lookout for a communication from CMS in the near future, however, just in case.

As many as 30,000 people made up of a mix of both civilian and military personnel have had their personal and financial information exposed. This exposure is what has been reported as a major security breach of the Pentagon.

This is proof positive that no organization is safe from watchful hackers scattered all around the world.

The Associated Press report on the incident includes:

“The department is continuing to gather additional information about the incident, which involves the potential compromise of Personally Identifiable Information (PII) of DoD personnel maintained by a single commercial vendor that provided travel management services to the department.  This vendor was performing a small percentage of the overall travel management services of the DoD…The department is continuing to assess the risk of harm and will ensure notifications are made to affected personnel.”

While there’s no good time for a data breach like this, it couldn’t have come at a worse time. The Government Accountability Office (GAO) had issued a scathing report of critical vulnerabilities in virtually all of the weapons systems programs the agency currently runs.

A small excerpt of the report reads as follows:

“One test report indicated that the test team was able to guess an administrator password in nine seconds…Multiple weapon systems used commercial or open source software, but did not change the default password when the software was installed, which allowed test teams to look up the password on the internet and gain administrator privileges for that software.”

It gets worse.  When confronted with the findings of the report, Pentagon officials dismissed the report as being unrealistic.

Clearly, there was something to the report, or this breach would not have happened.  The hope is that it will be sufficient to cause Pentagon officials to do some soul searching and reevaluate their positions.  If not, you can bet that something like this will happen again.

If you use the GovPayNet portal, be advised that your personal information is currently at risk. Although at this point, there’s no indication that any hacker has made use of it.  The portal is run by Government Payment Service, and is used by many Americans to pay fines, fees and bills generated by more than two thousand different government agencies operating in 35 states.

Unfortunately, the way the website is configured, when it issues a receipt for a payment, it numbers those receipts sequentially. All a hacker would have to do would be to change the receipt number in the URL to see any previous receipts, and all of the information it contains.

When the flaw was discovered by journalist Brian Krebs, more than fourteen million old records were exposed in this manner.  He contacted Government Payment Service to inform them of the flaw, and the agency moved quickly to address the issue. They said in a formal statement that they “did not adequately restrict access to only authorized recipients.”

They went on to assure their users that there’s no indication that any data had been improperly accessed. They added that the receipts generated don’t include any information that could be used by a hacker to initiate any type of financial transaction.

Unfortunately, the reality was a bit different.  The receipts contain the names, addresses and phone numbers of the person paying the fee in question, along with the last four digits of whatever credit or debit card was used to make payment. That is more than enough information to enable a hacker to initiate a phishing attack to get the rest.

Nick Bilorgoskiy of Juniper Networks had this to say about the matter:

“Online payment providers…should take special care to protect their customers’ receipts by using HTTPS and checking that the user is logged in and has permissions to view them.  To avoid information disclosure and directory traversal issues, I also recommend denying anonymous web visitors the ability to read permissions for any unnecessary files from web-accessible directories.”

It’s good advice, and here’s hoping that Government Payment Service will take it.  If you use the service, there’s nothing for you to do.  You don’t need to change your password, since it was never exposed.  Just be mindful that someone may have seen any data your receipts contain before the site was secured.