NASCO exposes data of 800K people in MOVEit breach
NASCO stored files with private data on MOVEit servers, which were attacked by Russia-related threat actors.
Image by Cybernews
NASCO stored files with private data on MOVEit servers, which were attacked by Russia-related threat actors.
The notice to affected clients on October 27th stated that the National Account Service Company (NASCO) used MOVEit Transfer, a third-party software application, to exchange files. It joins a long list of companies affected by the attack on the software at the end of May.
Threat actors were able to access NASCO’s MOVEit Transfer environment and acquire clients’ private data, including names and Social Security numbers. The MOVEit server affected by the attack was “decommissioned and is no longer accessible from the internet.”
NASCO says that it has stopped using MOVEit services in response to the cyberattack.
The Office of the Maine Attorney General states that more than 804,862 people were affected by the breach. The company has offered affected individuals identity monitoring services for 24 months.
NASCO is a healthcare technology company that provides benefits administration services to Blue Cross and Blue Shield health insurance customers.
The MOVEit hack has affected millions
The MOVEit transfer service fell victim to a zero-day exploit, which is a cyberattack targeting a vulnerability that’s unknown to either the software’s creators or antivirus vendors. The attacker spots the software vulnerability before any parties interested in mitigating it, quickly creates an exploit, and uses it for an attack.
In total, around 2100 organizations and 62 million people have been confirmed to be impacted by the MOVEit Transfer attacks, and new victims continue to come forward. Four major European banks – Deutsche Bank, ING Bank, Postbank, and Comdirect – reported customer data leaks linked to the MOVEit hack.
Other named victims include American Airlines, TJX off-price department stores, TomTom, Pioneer Electronics, Autozone, Johns Hopkins University and Health System, Warner Bros Discovery, AMC Theatres, Choice Hotels’ Radisson Americas chain, and Crowe accounting advisory firm.