Centers for Medicare & Medicaid Services Data Breach 2025: 107,154 Beneficiaries Exposed in Medicare.gov Account-Takeover Scheme. What To Do.

The Centers for Medicare & Medicaid Services - the federal agency that administers Medicare and Medicaid for roughly 160 million Americans - filed a HIPAA breach report with the HHS Office for Civil Rights on June 30, 2025, logging 107,154 affected individuals in a Hacking/IT Incident classified at Network Server. CMS’ public press release rounds the count to “approximately 103,000”; the higher OCR figure reflects the final tally submitted in the regulatory filing.

This was not a cyber intrusion into CMS systems. It was an account-takeover scheme: an unidentified threat actor used valid beneficiary personal data, obtained from “unknown external sources” per CMS, to fraudulently create Medicare.gov online accounts in beneficiaries’ names. Once those accounts existed, the attackers could see additional beneficiary data inside the portal. The compromised credentials almost certainly came from a third-party data breach elsewhere - not from CMS itself - but the agency has not named the upstream source.

Timeline

• 2023-2025 — Malicious actors fraudulently create Medicare.gov accounts using valid beneficiary information (MBI, coverage start date, last name, date of birth, ZIP code) sourced externally.
• May 2, 2025 — 1-800-MEDICARE call center begins receiving calls from beneficiaries who received written confirmation letters for accounts they had never opened. CMS opens its investigation.
• June 30, 2025 — CMS files the breach with HHS OCR, logging 107,154 affected individuals.
• July 1, 2025 — CMS issues a public press release and begins mailing individual notification letters. New Medicare cards with replacement MBIs are issued to affected beneficiaries.

What was exposed

The data used to create the fraudulent accounts (i.e., what the attackers already had in hand before logging in):

• Medicare Beneficiary Identifier (MBI)
• Coverage start date
• Last name
• Date of birth
• ZIP code

Additional data the attackers may have viewed once inside the fraudulent Medicare.gov accounts:

• Mailing address
• Provider information
• Dates of service
• Diagnosis codes
• Services received
• Plan premium details

CMS has stated it is “not aware of any reports of identity fraud or misuse” tied to the incident.

Sensitive-population considerations

The affected population skews older and is structurally more vulnerable than the average breach victim. Medicare beneficiaries are overwhelmingly age 65 and older, disabled adults under 65, and people with end-stage renal disease. Many are on fixed incomes; many manage their own health care without an adult child or caregiver to help review mail and account statements; many are not regular online-account users. The Medicare.gov account is also a high-value target because it can be used to redirect provider correspondence, change communication preferences, and pull together a complete claims history - exactly the raw material for Medicare fraud schemes targeting seniors.

If you are helping a parent, grandparent, or older relative who is a Medicare beneficiary, treat any letter from CMS or Medicare about this incident as worth opening with them, not for them, and walk through the steps below together.

What CMS is offering

• New Medicare Beneficiary Identifier (MBI) and new Medicare card mailed to each affected beneficiary. This is the central protective action - it invalidates the old number the attacker used.
• Deactivation of all fraudulently created Medicare.gov accounts.
• New control: account creation from foreign IP addresses has been disabled.
• Ongoing claims monitoring for suspicious activity tied to affected MBIs.
• Individual notification letters mailed to each affected beneficiary explaining the incident and the steps CMS is taking.

CMS did not publicly announce a complimentary credit-monitoring offering at the time of the notification. If your individual letter includes a credit-monitoring activation code, follow the instructions in the letter; otherwise the protective steps below apply.

Class-action posture

As of this writing, no class-action complaint against CMS over this specific incident has been publicly identified. That is consistent with the legal reality that the federal government enjoys sovereign-immunity defenses that make data-breach class actions against federal agencies harder to bring than against private companies. Plaintiff firms have not announced public investigations of this incident in the trade press tracked here. We update this page if that changes.

What to do — Medicare-fraud-specific guidance

1. Read any letter from CMS or Medicare carefully. It will tell you whether you are one of the 107,154 affected beneficiaries and whether a new Medicare card with a new MBI is on its way. Do not throw it away.
2. When the new Medicare card arrives, start using it immediately. Destroy the old card. Give the new MBI to your providers and your Medicare Advantage or Part D plan if you have one. The old MBI is the number the attacker had; the new one is the protection.
3. Review your Medicare Summary Notice (MSN) or your Medicare Advantage Explanation of Benefits. Look for services, providers, dates, or equipment you do not recognize. Medicare fraud often shows up as durable medical equipment (back braces, knee braces, catheters), genetic-testing kits, or visits with providers you have never seen.
4. Report suspected Medicare fraud to 1-800-MEDICARE (1-800-633-4227) or to the HHS Office of Inspector General hotline at 1-800-HHS-TIPS. Reports are confidential.
5. Be on guard for phone scams that name-drop this breach. Real Medicare will not call you out of the blue to “confirm” your new MBI, ask for your Social Security number, or ask for a payment to “activate” your new card. If a caller does any of those things, hang up and call 1-800-MEDICARE directly using the number on the back of your card.
6. Consider freezing your credit with all three nationwide consumer reporting agencies (Equifax, Experian, TransUnion). It is free, can be done by phone or online, and is the single highest-leverage step against new-account identity theft. This is general identity-theft hygiene; even though CMS has not reported Social Security number exposure for this specific incident, the underlying compromise that fed the attackers’ Medicare.gov inputs may have included other data not yet attributed.
7. Bookmark this page. We update it as new public information becomes available.

Sources

• CMS Press Release: Notifies Individuals Potentially Impacted by Data Incident — the agency’s own statement and the basis for most reporting on this incident.
• HIPAA Journal: CMS Notifies 103,000 Medicare Beneficiaries About Unauthorized Account Creation — trade-press summary with timeline and data-element list.
• BankInfoSecurity / GovInfoSecurity: Feds Notify 103,000 Medicare Beneficiaries of Scam, Breach — independent confirmation of scope and CMS response measures.
• Newsweek: 100,000 Americans To Get New Medicare Numbers After Data Incident — general-press coverage focused on the new-MBI remediation.
• HHS Office for Civil Rights Breach Portal — the federal regulatory record of this breach (107,154 individuals; Hacking/IT Incident at Network Server; filed 2025-06-30).

I confirm this entry is sourced to CMS’ own press release plus HIPAA Journal, GovInfoSecurity, Newsweek, and the HHS OCR portal record, and is distinct from the 2024 Wisconsin Physicians Service / MOVEit incident (946,801 beneficiaries) that involved a CMS contractor rather than the Medicare.gov account-creation channel.