MOVEit File Transfer Breach: An Incident Response Guide for Pharmacy Benefit Managers

How did the MOVEit vulnerability expose pharmacy benefit manager data?

MOVEit Transfer is software organizations use to exchange files. In 2023, attackers exploited a SQL injection vulnerability, CVE-2023-34362, in internet-accessible MOVEit Transfer systems. The FBI and CISA reported that the attackers used the flaw to install a web shell that could interact with the system and retrieve files. A PBM’s data could therefore be at risk if it—or a vendor handling its files—used an affected, exposed system during the relevant period. FBI and CISA’s MOVEit advisory

The vulnerability did not automatically expose every file handled by every PBM or vendor. Exposure depends on whether the relevant MOVEit environment was affected and exploited, what files it held, and whether those files were accessed or copied. Progress’s security advisory describes the vulnerability and remediation guidance for affected MOVEit Transfer installations.

For a pharmacy benefit manager, third-party vendor risk can extend beyond the PBM’s own systems. A claims processor, benefits administrator, clearinghouse, or other business partner may have handled files on its behalf. Confirm which organizations used MOVEit, what environments and dates were involved, and which parties had responsibility for the affected information.

Which pharmacy and health information may have been compromised?

The information at risk depends on the contents of the files stored or exchanged through the affected environment. Files might contain names, addresses, dates of birth, member or plan identifiers, Medicare claims data, prescription details, pharmacy names, dates of service, or amounts paid. A file could also contain contact or financial information, depending on the purpose of the transfer. These are possibilities, not a statement that every affected file contained each data type.

Prescription claims can reveal sensitive details about a person’s health and medication use. Medicare drug plan Explanation of Benefits statements, for example, summarize prescription claims and costs. Medicare’s explanation of benefits information

Use a historical file inventories review to identify the actual files, date ranges, recipients, and data fields involved. Map affected files to individuals where possible, and distinguish confirmed contents from information that remains under investigation. Do not assume that every person whose file was present had every category of information exposed.

How can PBMs determine whether MOVEit files were accessed or copied?

Start by asking the vendor for a written account of its investigation. Request the affected MOVEit instances, software versions, exposure periods, containment steps, known indicators of compromise, file inventories, and evidence of access or transfer. Ask what records support its conclusions and whether independent forensic specialists reviewed the environment.

Compare the vendor’s file inventory with transfer histories, user and administrator activity, web-server and system logs, database records, and relevant network or endpoint telemetry. Review historical file inventories and delivery records to connect each potentially affected file to its contents, sender, recipient, and intended purpose. Preserve logs and forensic evidence before routine retention or system changes make them unavailable; CISA’s incident response playbooks emphasize collecting and preserving data during investigation.

Interpret the results carefully. Evidence that a file was stored on a system does not, by itself, prove it was copied. Conversely, missing or incomplete logs do not establish that no access occurred. Document what is confirmed, what is reasonably believed, and what cannot be determined, then use that evidence to assess the scope and notification obligations.

What should PBMs do to contain and investigate a third-party breach?

Activate your incident response plan and bring together security, privacy, legal, compliance, operations, communications, and vendor-management teams. Coordinate with the affected vendor and other responsible organizations to contain the incident while preserving evidence and maintaining essential pharmacy services. CISA recommends isolating affected systems as appropriate and preserving forensic evidence and logs. CISA’s cybersecurity best practices

• Confirm which systems, files, time periods, and business partners were involved, and request supporting evidence from the vendor.
• Work with technical responders to restrict unauthorized access, remove suspicious accounts or sessions, apply the vendor’s appropriate security fixes, and review credentials and access permissions.
• Preserve relevant logs, file records, and forensic materials. Record investigative decisions, evidence sources, and any remaining uncertainties.
• Assess which organizations hold relevant duties under contracts, business associate agreements, HIPAA, and any other applicable requirements.
• Develop a notification and support plan based on the data and individuals involved, and coordinate communications among the PBM, health plan, and vendor.

HIPAA responsibilities depend on each organization’s role. A vendor handling protected health information for a covered entity may be a business associate, and business associate agreements can specify reporting and notification responsibilities. HHS guidance on business associates explains relevant relationships; HHS sample business associate agreement provisions note that agreements may set more specific breach-reporting arrangements.

Under the HIPAA Breach Notification Rule, a business associate must notify the covered entity of a breach of unsecured protected health information without unreasonable delay and no later than 60 calendar days after discovery. Covered entities generally must notify affected individuals without unreasonable delay and no later than 60 days after discovery; other reporting obligations depend on the number of affected individuals and circumstances. The 60-day limit is an outer deadline, not a reason to postpone notice when it can be provided sooner. Check the current HHS breach notification guidance and applicable agreements with counsel.

How should PBMs notify affected members and provide support?

Give affected members a clear, direct notice that explains what happened, when it happened, what types of information were involved, what the organization is doing, and what members can do. Avoid claiming that information was stolen if the investigation has not established that; describe confirmed facts and clearly label what is still being investigated.

For notices required under HIPAA, HHS says individual notices should explain the breach, the types of information involved, steps individuals can take to protect themselves, what the organization is doing to investigate and mitigate harm, and how to contact it. Notices must be provided without unreasonable delay and no later than 60 days after discovery. HHS’s Breach Notification Rule guidance

Provide a dedicated contact channel with trained staff who can explain the incident, confirm whether a person’s information was involved when that information is available, and route questions about pharmacy access or claims. If appropriate to the data and assessed risk, consider offering identity restoration services and explain exactly what they cover, how to use them, and any time limits. Do not imply these services are required by HIPAA or that they prevent all misuse.

Tell members to use contact information they independently verify, such as the number on their plan card or the plan’s official website. Remind them not to share sensitive information in response to an unexpected call, email, or text. Medicare advises people to protect their Medicare Number and be cautious about unsolicited requests for personal information. Medicare guidance on protecting your Medicare card

What do affected individuals need to know about Medicare benefits and coverage?

A data breach by itself is not a Medicare coverage decision and does not, on its own, determine whether a person remains eligible for Medicare or covered by a plan. Coverage decisions continue to follow the applicable program and plan rules. If a member has a question about a prescription, payment, or plan decision, they should contact their Medicare drug plan; Medicare explains that members can ask their plan about drug coverage decisions and appeals. Medicare’s information on member rights

Members should review their prescription drug plan Explanation of Benefits for unfamiliar prescriptions, pharmacies, dates, or costs, and contact the plan about suspected errors. Medicare says these notices summarize prescription claims and costs and directs members to contact their plan with questions or suspected fraud. Medicare’s Explanation of Benefits guidance

If someone suspects Medicare fraud, they can contact 1-800-MEDICARE or report it through Medicare. People with a Medicare Advantage or Medicare drug plan can also contact the Investigations Medicare Drug Integrity Contractor. Medicare’s fraud and abuse reporting guidance

In short, PBMs should establish what files and people were affected, preserve evidence, coordinate containment and legal review, and provide timely, specific member support. Members should follow verified instructions, review prescription claims, and contact their plan or Medicare if they find suspicious activity.

FAQs.

Could a MOVEit breach expose files held by a PBM vendor?

Yes, if a vendor used an affected MOVEit Transfer environment and files related to the PBM or its members were present there. Whether particular files were accessed or copied requires investigation of the vendor’s systems, records, and file inventory.

What types of pharmacy or Medicare information may have been exposed?

Depending on the affected files, information could include member identifiers, Medicare claims data, prescription details, pharmacy and service dates, or claim costs. The actual information involved varies by file and must be confirmed through a historical file review.

How can affected members find out whether their information was involved?

Follow the instructions in an official notice and use the organization’s verified contact channel. The PBM, health plan, or vendor should provide a way to ask whether your information was involved when that information is available.

Does a MOVEit data breach affect Medicare benefits or coverage?

A breach alone is not a coverage decision. If you have questions about a prescription claim, payment, or plan decision, contact your Medicare drug plan; review your Explanation of Benefits and report suspected Medicare fraud through Medicare’s official channels.