Overview
More than 134,000 Massachusetts residents who are currently enrolled in certain state programs and services (or were enrolled in the last few years) had their personal information involved in a recent global third-party data security incident.
Impacted individuals were sent notice by mail starting Aug. 14, 2023, and will also be contacted by phone, text, and email where possible.
This was part of a large, global data security incident involving a file-transfer software program called MOVEit that has impacted state and federal government agencies, financial services firms, pension funds, and many other types of companies and not-for-profit organizations. No UMass Chan or state systems were compromised in this incident.
The University of Massachusetts Chan Medical School (“UMass Chan”) provides services to the Executive Office of Health and Human Services (EOHHS). MOVEit was used to transfer files as part of the services provided by UMass Chan to certain EOHHS agencies and programs.
State Supplement Program (SSP) participants (including recipients, other members of the household and authorized representatives), MassHealth Premium Assistance members, MassHealth Community Case Management participants, and Executive Office of Elder Affairs (EOEA) and Aging Services Access Points (ASAP) home care program consumers were primarily impacted. If you do not participate in one of those programs, it is unlikely your data was exposed.
How can I find out if my information was involved?
Beginning on August 15, 2023, individuals whose information was involved will get letters from the Commonwealth of Massachusetts and UMass Chan.
State Supplement Program (SSP) participants (including recipients, other members of the household and authorized representatives), MassHealth Premium Assistance members, MassHealth Community Case Management participants, and Executive Office of Elder Affairs (EOEA) and Aging Services Access Points (ASAP) home care program consumers were primarily impacted. If you do not participate in one of those programs, it is unlikely your data was exposed.
What should I do if my information was involved?
If your information was involved, you will get a letter that explains what data was impacted and what steps you can take to protect your information.
Impacted individuals are encouraged to remain vigilant by reviewing their financial account statements. If you see charges or activity that you did not authorize, contact your bank or financial institution immediately. Take steps to protect your accounts by contacting your bank, credit union, or financial institution immediately by using the number on the back of your bank card or by visiting in person to notify them of your involvement in this security incident.
UMass Chan is offering free credit monitoring and identity theft protection services to individuals whose Social Security numbers and/or financial information were involved in this incident. The letter you will get has more details, including steps to sign up for credit monitoring and identity theft protection.
Individuals who receive notification that their data is involved and have further questions may call 855-862-7769, Monday through Friday, from 9:00 a.m. to 5:00 p.m., ET.
Why is UMass Chan involved?
UMass Chan is involved because they provide services to EOHHS, including for MassHealth, the State Supplement Program (SSP), Family Resource Centers (FRCs), the Executive Office of Elder Affairs (EOEA) and the Aging Services Access Points (ASAPs).
What is MOVEit?
MOVEit is a file transfer software program licensed by a company called Progress Software.
MOVEit was used to transfer files as part of the services provided by UMass to certain EOHHS agencies and programs.
Contact for MOVEit global data security incident
Phone
Monday through Friday, from 9:00 a.m. to 5:00 p.m., ET.
| Date published: | August 15, 2023 |
|---|