CMS Data Breach Exposes 103,000 Medicare Accounts

A major cybersecurity incident has exposed sensitive personal and health records of tens of thousands of Americans. The Centers for Medicare & Medicaid Services (CMS) has announced that 103,000 individuals across the United States with accounts on Medicare.gov are impacted by a data breach. The federal agency discovered the breach after receiving multiple complaints through its call center. Hackers may have used information from external sources to collect data such as names, dates of birth, Medicare Beneficiary Identifiers, coverage start dates, and ZIP codes to fraudulently create Medicare.gov accounts.

Once inside, the thieves gained access to more sensitive data, including provider details, mailing addresses, dates of service, diagnosis codes, services received, and plan premiums. The CMS noticed the similarities in the reports and investigated further, discovering more cases of accounts created between 2023 and 2025 that matched this pattern. The agency quickly deactivated those accounts and launched a larger effort to find the bad actors who created them.

The CMS is a federal agency under the U.S. Department of Health and Human Services tasked with overseeing the country’s healthcare programs, including Medicare, Medicaid, the Children’s Health Insurance Program, and Health Insurance Marketplace. The agency is encouraging affected individuals to get a free credit report from each of the three major nationwide credit reporting companies. The CMS has not received any reports of identity fraud or improper use of personal information as a result of the incident.