...
By James Bickerton
News Reporter
0
Share
Newsweek is a Trust Project member
See more of our trusted coverage when you search.Prefer Newsweek on Googleto see more of our trusted coverage when you search.
The federal Centers for Medicare & Medicaid Services (CMS) has written to approximately 103,000 Medicare recipients warning them that their personal information may have been compromised "in a data incident," and saying they will get new Medicare numbers.
The agency added it was "not aware of any reports of identity fraud or misuse of the information as a direct result of this activity" and said it was taking action "out of an abundance of caution."
Newsweek contacted the CMS for comment on Tuesday via online inquiry form outside of regular office hours.
Read More on U.S.
Why It Matters
According to government figures, more than 66 million Americans receive medical coverage through Medicare, meaning any breach to the CMS's data security is likely to cause widespread anxiety.
The CMS's letter to more than 100,000 Medicare recipients includes "guidance on actions they may wish to take" to protect their personal data.
What To Know
In a press release published on Tuesday, the CMS said it had written to the Medicare beneficiaries "whose personal information may have been involved in a data incident affecting Medicare.gov accounts."
The agency said it had "identified suspicious activity related to unauthorized creation of certain beneficiary online accounts using personal information obtained from unknown external sources."
In response, the CMS said it had "worked quickly" to deactivate impacted accounts and is investigating the scope of the suspected data breach and what impact it could have on recipients.
In its letter, the agency said that on May 2, its call center "began receiving inquiries from beneficiaries who received letters confirming the creation of Medicare.gov accounts they did not initiate."
...
An investigation concluded "malicious actors had fraudulently created new accounts between 2023 and 2025 using valid beneficiary information." This information included Medicare Beneficiary Identifiers (MBI), last names, zip codes, dates of birth and coverage start dates.
Using these "unauthorized accounts," the CMS said, "bad actors" may also have been able to access some Medicare recipients' mailing addresses, provider information, diagnosis codes, services received, plan premium details and dates of service.
Those impacted were told they will receive a new Medicare card, complete with a fresh Medicare number, in the mail over the coming weeks. The FBI declined to comment when contacted by Newsweek.
On Monday, FBI Deputy Director Dan Bongino said the agency was "announcing the results from the largest health care fraud investigation, as measured by financial losses, in DOJ history." This resulted in nearly $15 billion in losses with $245 million being seized back by authorities and 324 people charged with various offenses.
What People Are Saying
In its letter to roughly 103,000 Medicare recipients, the CMS said: "We're writing to inform you of an incident involving your personal information related to your Medicare.gov account. To help make sure your privacy is protected, we will mail you a new Medicare card with a new Medicare Number in the coming weeks.
"The incident involved currently unknown bad actors who accessed your data from an unknown source to fraudulently create Medicare.gov accounts."
What Happens Next
The CMS said it is continuing to investigate what took place with the "data incident," including whether any sensitive personal information was compromised.
Update 7/3/25, 4:01 a.m. ET: This story has been updated to note that the FBI declined to comment.
View 0 Comments
Submit Correction
View Editorial & AI Guidelines