Welltok’s MOVEit Breach Returns, Another 426k Records Exposed

Welltok operates an online wellness program various organizations use to encourage healthy lifestyles. They’ve been in our news frequently as the global MOVEit breach continues. Around nine million people have had their information exposed resulting from Welltok’s breach in the last few weeks; this week, Welltok’s breach returns with a double threat target—Premier Health and Graphic Packaging International. 

How Did the Attack Occur? 

The global MOVEit breach was made possible by a zero-day vulnerability, allowing access to the internal data of many organizations. MOVEit’s many features make it a widely chosen file management option across industries, including healthcare and servicing organizations. Welltok presumably used MOVEit to manage and maintain member data, facilitating their brand ideals. Premier Health and Graphic Packaging International used Welltok’s services, resulting in assailants breaching their member group information. 

What Information Was Viewed or Stolen? 

The stolen information differs between individuals and their respective available data. Both organizations suggest that the attackers may have accessed the following credentials: names, birthdays, Social Security Numbers, prescription and provider details, and health insurance plan numbers. Regarding Graphic Packaging International, the taken information may include provider information; conversely, Premier Health may include patient data or group identification numbers. We recommend all those with associations take preventative actions to mitigate the risk of data misuse. 

How Did Welltok Admit to the Breach? 

There are two timelines for this data breach. Both organizations started their timeline on May 31st, 2023; this was the day Progress Software publicly announced the MOVEit zero-day vulnerability. Immediately, organizations using the software began internal investigations, including Welltok. Graphic Packaging International received a potential breach notice in late August, while Premier Health obtained theirs almost a month later. 

The breach filing on the Maine Attorney General’s website states officials found the breaches in late October; however, the published consumer notices suggest the discovery of both incidents happened within a week. Impacted consumers should expect a breach notice in the mail, as officials sent notifications around November 22nd. 

What Will Become of the Stolen Information? 

According to the filing on Maine’s website, the assailants accessed an estimated 426,812 records in the breach. How the assailants will use the data in the future is a more challenging question. There are no indications of who the assailants were or their plans. The cybercriminals were likely not involved with the ransomware gang CL0P; they have claimed responsibility for significant data losses from the MOVEit event. Regardless of who committed the breach or why, affected parties must act to protect themselves. 

What Should Affected Parties Do in the Aftermath of the Breach? 

The hackers could use the stolen data in this breach in many ways. The assailants could ransom the data back to Welltok, although, at this stage, it is unlikely. They could alternatively sell the credentials online to other actors looking to turn a profit through fraud and impersonation plots. Otherwise, they might keep the data for themselves. Those who find suspicious activity within their account must act immediately to contain the threat; for everyone else, only preventative measures like account monitoring and multi-factor authentications can mitigate data misuse.