CMS Medicare.gov Accounts 2025 Data Breach

The primary evidence is CMS's official June 30, 2025 press release and sample notification letter. The agency says actors used data obtained from an unknown external source to create fraudulent Medicare.gov accounts and may then have accessed additional beneficiary information. This is an account-fraud incident separate from the 2023 CMS contractor MOVEit breach.

The HHS OCR row classifies the organization as a Health Plan, the event as a Hacking/IT Incident, and the information location as Network Server; it lists 107,154 people. Healthcare Finance News independently reviewed the CMS statement and reported how the fraudulent accounts operated, the identity fields used, and the agency's response. The sources align on method, timing, and data scope.

On May 2, 2025, the CMS 1-800-MEDICARE call center began receiving inquiries from beneficiaries who had received confirmation letters for Medicare.gov accounts they did not create. The agency promptly opened an investigation and found that malicious actors had used valid beneficiary information to create new accounts between 2023 and 2025.

The public statement does not identify a single first attack day and says fraudulent creation occurred across the 2023-2025 period. The incident date is based on the earliest technical activity that can be verified from public sources. June 30 on the HHS row is the public report date and is not interpreted as the incident's beginning.

The fields used to create accounts were Medicare beneficiary identifiers, Medicare coverage start dates, last names, dates of birth, and ZIP codes. Those inputs came from unknown sources outside CMS, but their valid combination allowed the actors to establish unauthorized identities inside Medicare.gov.

After the accounts were created, the actors may also have viewed provider information, mailing addresses, dates of service, diagnosis codes, services received, and plan premium details. Unverified person counts, data fields, and threat-actor claims are not treated as part of the public incident scope. It also does not assume that every field applied to all 107,154 people.

The initial CMS announcement rounded the affected population to approximately 103,000 beneficiaries. The affected-person or record count published by the official source represents the reported scope of the incident. It does not mean that every disclosed data category applied to every person. The earlier approximate number is not added or treated as a separate event.

This figure is not a count of fraudulent accounts, viewed pages, claims, or data fields; it represents people in the breach-notification population. A single beneficiary account may contain multiple health, plan, and service details.

CMS deactivated all fraudulently created accounts and disabled creation of new Medicare.gov accounts from foreign IP addresses. It continued monitoring claims data for suspicious activity, replaced Medicare beneficiary identifiers for affected people, and mailed new Medicare cards carrying new identifiers when needed.

When the official statement was issued, CMS knew of no reports of identity fraud or direct misuse resulting from the activity. The agency nevertheless applied the changes as precautions. People receiving replacement cards should stop using the former Medicare number and ensure that their healthcare providers record the new identifier.

Notice recipients should regularly review Medicare Summary Notices and insurance explanations of benefits for unfamiliar charges, doctors, diagnoses, or services. Suspicious activity can be reported to 1-800-MEDICARE or the HHS Office of Inspector General. If a replacement card arrived, claims using the former Medicare number deserve particular scrutiny.

Links in unexpected account-verification, card-renewal, or payment messages using CMS or Medicare branding should not be opened directly; contact should begin at Medicare.gov or the official number printed on the card. Free credit reports can also be monitored for identity-abuse indicators.