Delta Dental of California and affiliated companies began notifying patients on December 14, 2023 that their personal information had been taken through the mass exploitation of Progress Software's MOVEit Transfer product.
The insurer said it learned of the compromise on June 1, 2023 and determined that an unauthorized party had accessed and copied data from its systems between May 27 and May 30, 2023. That window matches the Clop ransomware group's exploitation of CVE-2023-34362, a zero-day flaw in MOVEit that Progress patched on May 31. A second, longer investigation into exactly who was affected concluded on November 27, 2023.
Roughly 6.93 million people were listed as affected, a figure most outlets rounded to about 7 million. HIPAA Journal placed it as the third largest MOVEit breach in the healthcare sector, behind Maximus and Welltok. The stolen records combined names with one or more of the following: address, Social Security number, driver's license or state identification number, passport number, financial account information, tax identification number, health insurance policy number and health information.
Delta Dental notified law enforcement, set up a dedicated call line and offered affected individuals 24 months of credit monitoring and identity theft protection services.